CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-28975
https://notcve.org/view.php?id=CVE-2022-28975
09 Jan 2024 — A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field. Vulnerabilidad de Cross-Site Scripting (XSS) almacenado en Infoblox NIOS v8.5.2-409296 permite a los atacantes ejecutar scripts web o HTML arbitrarios a través de un payload manipulado inyectadp en el campo VLAN View Name. • http://infoblox.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37249
https://notcve.org/view.php?id=CVE-2023-37249
25 Aug 2023 — Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access. • https://community.infoblox.com/t5/trending-kb-articles/nios-is-vulnerable-to-cve-2023-37249/ba-p/32190 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-32972
https://notcve.org/view.php?id=CVE-2022-32972
17 Feb 2023 — Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. • https://community.infoblox.com/t5/trending-kb-articles/cve-2022-32972-infoblox-bloxone-endpoint-for-windows-local/ba-p/24912 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15303
https://notcve.org/view.php?id=CVE-2020-15303
28 Jun 2021 — Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. Infoblox NIOS versiones anteriores a 8.5.2, permite una expansión de entidades durante una operación de carga XML, un problema relacionado con CVE-2003-1564 • https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995 • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2018-10239
https://notcve.org/view.php?id=CVE-2018-10239
17 Jun 2019 — A privilege escalation vulnerability in the "support access" feature on Infoblox NIOS 6.8 through 8.4.1 could allow a locally authenticated administrator to temporarily gain additional privileges on an affected device and perform actions within the super user scope. The vulnerability is due to a weakness in the "support access" password generation algorithm. A locally authenticated administrative user may be able to exploit this vulnerability if the "support access" feature is enabled, they know the support... • https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-6643
https://notcve.org/view.php?id=CVE-2018-6643
28 Aug 2018 — Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter. Infoblox NetMRI 7.1.1 tiene Cross-Site Scripting (XSS) reflejado mediante el parámetro query en /api/docs/index.php. • https://github.com/undefinedmode/CVE-2018-6643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-6484 – Infoblox 7.0.1 CRLF Injection / HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2016-6484
07 Sep 2016 — CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf. Vulnerabilidad de inyección CRLF en Infoblox Network Automation NetMRI en versiones anteriores a 7.1.1 permite a atacantes remotos inyectar encabezados HTTP arbitrarios y llevar acabo ataques de división de respuesta HTTP a través del parámetro content... • https://packetstorm.news/files/id/138615 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2015-2033
https://notcve.org/view.php?id=CVE-2015-2033
20 Feb 2015 — Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request. Anyterm Daemon en Infoblox Network Automation NetMRI anterior a NETMRI-23483 permite a atacantes remotos ejecutar comandos arbitrarios con privilegios de root a través de una respuesta terminal/anyterm-module manipulada. • http://unsecurityresearch.com/index.php?option=com_content&view=article&id=46&Itemid=53 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 3CVE-2014-3419 – Infoblox 6.8.4.x Weak MySQL Password
https://notcve.org/view.php?id=CVE-2014-3419
09 Jul 2014 — Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors. Infoblox NetMRI anterior a 6.8.5 tiene una contraseña de administración por defecto para la cuenta de la base de datos MySQL 'root', lo que facilita a usuarios locales obtener el acceso a través de vectores no especificados. Infoblox versions 6.4.x.x through 6.8.4.x use a default login of root with password root on their MySQL ins... • https://packetstorm.news/files/id/127410 • CWE-255: Credentials Management Errors •
CVSS: 10.0EPSS: 33%CPEs: 6EXPL: 5CVE-2014-3418 – Infoblox 6.8.2.11 - OS Command Injection
https://notcve.org/view.php?id=CVE-2014-3418
09 Jul 2014 — config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter. config/userAdmin/login.tdf en Infoblox NetMRI anterior a 6.8.5 permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en el parámetro skipjackUsername. Infoblox versions 6.4.x.x through 6.8.4.x suffer from a remote OS command injection vulnerability. • https://packetstorm.news/files/id/127409 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •