CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-6643
https://notcve.org/view.php?id=CVE-2018-6643
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter. Infoblox NetMRI 7.1.1 tiene Cross-Site Scripting (XSS) reflejado mediante el parámetro query en /api/docs/index.php. • https://github.com/undefinedmode/CVE-2018-6643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6484 – Infoblox 7.0.1 CRLF Injection / HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2016-6484
CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf. Vulnerabilidad de inyección CRLF en Infoblox Network Automation NetMRI en versiones anteriores a 7.1.1 permite a atacantes remotos inyectar encabezados HTTP arbitrarios y llevar acabo ataques de división de respuesta HTTP a través del parámetro contentType en una acción de inicio de sesión para config/userAdmin/login.tdf. Infoblox versions 7.0.1 and below suffer from CRLF injection attacks that allow for HTTP response splitting. • http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.html http://www.securityfocus.com/archive/1/539366/100/0/threaded http://www.securityfocus.com/bid/92794 http://www.securitytracker.com/id/1036736 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2033
https://notcve.org/view.php?id=CVE-2015-2033
Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request. Anyterm Daemon en Infoblox Network Automation NetMRI anterior a NETMRI-23483 permite a atacantes remotos ejecutar comandos arbitrarios con privilegios de root a través de una respuesta terminal/anyterm-module manipulada. • http://unsecurityresearch.com/index.php?option=com_content&view=article&id=46&Itemid=53 http://www.securityfocus.com/bid/73423 https://support.infoblox.com/app/answers/detail/a_id/3666/kw/NETMRI-23483 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 2CVE-2014-3419 – Infoblox 6.8.4.x Weak MySQL Password
https://notcve.org/view.php?id=CVE-2014-3419
Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors. Infoblox NetMRI anterior a 6.8.5 tiene una contraseña de administración por defecto para la cuenta de la base de datos MySQL 'root', lo que facilita a usuarios locales obtener el acceso a través de vectores no especificados. Infoblox versions 6.4.x.x through 6.8.4.x use a default login of root with password root on their MySQL instances. • http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html http://packetstormsecurity.com/files/127410/Infoblox-6.8.4.x-Weak-MySQL-Password.html http://www.securityfocus.com/archive/1/532710/100/0/threaded http://www.securityfocus.com/bid/68473 http://www.securitytracker.com/id/1030542 https://exchange.xforce.ibmcloud.com/vulnerabilities/94450 https://github.com/depthsecurity/NetMRI-2014-3418 • CWE-255: Credentials Management Errors •
CVSS: 10.0EPSS: 14%CPEs: 6EXPL: 4CVE-2014-3418 – Infoblox 6.8.2.11 - OS Command Injection
https://notcve.org/view.php?id=CVE-2014-3418
config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter. config/userAdmin/login.tdf en Infoblox NetMRI anterior a 6.8.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro skipjackUsername. Infoblox versions 6.4.x.x through 6.8.4.x suffer from a remote OS command injection vulnerability. • https://www.exploit-db.com/exploits/34030 http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html http://seclists.org/fulldisclosure/2014/Jul/35 http://www.exploit-db.com/exploits/34030 http://www.securityfocus.com/archive/1/532709/100/0/threaded http://www.securityfocus.com/bid/68471 https://exchange.xforce.ibmcloud.com/vulnerabilities/94449 https://github.com/depthsecurity/NetMRI-2014-3418 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •