CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-5385 – Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks
https://notcve.org/view.php?id=CVE-2018-5385
Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations. Navarino Infinity es propenso a ataques de fijación de sesión. El servidor acepta el ID de sesión como parámetro GET, lo que puede conducir a la omisión de la autenticación de dos factores en algunas instalaciones. • http://www.securityfocus.com/bid/103544 https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html https://www.kb.cert.org/vuls/id/184077 • CWE-384: Session Fixation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-5384 – Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection
https://notcve.org/view.php?id=CVE-2018-5384
Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication. La interfaz web de Navarino Infinity hasta la versión 2.2 expone un script no autenticado que es propenso a una inyección SQL ciega. Si se explota con éxito, el usuario puede obtener información de la base de datos de postgresql subyacente que podría conducir al compromiso total del producto. • http://www.securityfocus.com/bid/103544 https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html https://www.kb.cert.org/vuls/id/184077 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-5386 – Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak
https://notcve.org/view.php?id=CVE-2018-5386
Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. Algunas funciones de Navarino Infinity, hasta la versión 2.2, pueden omitir cualquier mecanismo de autenticación si se colocan en la URL, lo que conduce a una fuga de información. • http://www.securityfocus.com/bid/103544 https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html https://www.kb.cert.org/vuls/id/184077 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-288: Authentication Bypass Using an Alternate Path or Channel •