CVE-2018-12311

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...

CVE-2018-12309

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

CVE-2018-12314

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

Directory traversal

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

CVE-2018-12312

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secretkey" URL parameter...

CVE-2018-12311

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...

Information disclosure

Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext...

Cross site scripting

Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...

Directory traversal

Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...

CVE-2018-12310

Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature...

CVE-2018-12318

CVE-2018-12318 relates to ASUSTOR ADM (versions including 3.1.1) where the SNMP settings page leaks the SNMP password in plaintext. The CVE is documented in multiple sources (NVD and CNVD entries) with the same basic impact: information disclosure. The root cause is an information disclosure flaw...

CVE-2018-12309

CVE-2018-12309 describes a directory traversal in ASUSTOR ADM 3.1.1, via upload.cgi, allowing an attacker to upload files to arbitrary locations by modifying the path URL parameter (the filename parameter is covered by CVE-2018-11345). NVD lists CVSS v3.0 base score 7.5 (HIGH) with network attack...

CVE-2018-12311

ASUSTOR ADM File Explorer (v3.1.1) is affected by a cross-site scripting vulnerability. When a file is moved using a malicious filename, an attacker can cause arbitrary JavaScript execution. The reports do not provide specific fixes or patch versions in the supplied documents.

CVE-2018-12308

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...

CVE-2018-12313

CVE-2018-12313 affects ASUSTOR ADM 3.1.1: OS command injection in snmp.cgi exploitable without authentication via the rocommunity parameter. Impact: remote code execution with high integrity/availability risk (CVSSv3/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8). Affected component: snmp.cgi in ADM;...

CVE-2018-12305

The provided connected sources confirm a Cross-site scripting vulnerability in ASUSTOR ADM 3.1.1 File Explorer. Specifically, uploading SVG images with embedded JavaScript allows an attacker to execute code. Affected product: ASUSTOR ADM (File Explorer component) version 3.1.1. Root cause: improp...

CVE-2018-12305

Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...

CVE-2018-12310

CVE-2018-12310 describes a cross-site scripting vulnerability in ASUSTOR ADM (login page, version 3.1.1) where an attacker can inject JavaScript through the System Announcement feature. Affected component: ASUSTOR ADM login flow. Underlying issue: stored/reflected XSS in the login surface (detail...

CVE-2018-12315

ASUSTOR ADM 3.1.1 contains a password verification bypass vulnerability: missing verification allows attackers to change account passwords without the current password. Affected component: ADM password handling. Root cause: inadequate password validation. Impact: unauthorized password changes (no...

CVE-2018-12317

CVE-2018-12317 relates to an OS command injection in ASUSTOR ADM 3.1.1 (group.cgi) that allows an attacker to run arbitrary commands as root by altering the name POST parameter. The vulnerability is described across NVD/CNVD entries as affecting ASUSTOR ADM on the affected NAS devices, with root-...