CVE-2018-11341

CVE-2018-11341 affects ASUSTOR AS6202T ADM 3.1.0.RFQ3; a vulnerability in importuser.cgi allows directory traversal via the filename parameter, enabling an attacker to navigate the file system. Affected component: importuser.cgi. Root cause: improper validation of the filename parameter leading t...

CVE-2018-11340

CVE-2018-11340 concerns an unrestricted file upload in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically the importuser.cgi endpoint. The underlying issue is that the program accepts an uploaded file and saves it with a user-supplied filename, enabling an attacker to place attacker-controlled code on ...

CVE-2018-11344

CVE-2018-11344 concerns ASUSTOR ADM 3.1.0.RFQ3 on AS6202T. A path traversal vulnerability in download.cgi via the file1 parameter allows an attacker to download arbitrary files from the system. Affected component: download.cgi; root cause: improper validation of file paths in file1. Proof of impa...

CVE-2018-11345

ASUSTOR AS6202T ADM 3.1.0.RFQ3 is affected by CVE-2018-11345: an unrestricted file upload vulnerability in upload.cgi that allows uploading data via the POST parameter filename and, due to path traversal in that parameter, placing files anywhere on the filesystem. This can enable attacker-control...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability (CNVD-2018-10309)

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A security vulnerability exists in the upload.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3. An attacker can exploit the vulnerability by uploading data with the help of the 'filename' POST...

ASUSTOR AS6202T ADM Unrestricted File Upload Vulnerability

ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. An arbitrary file upload vulnerability exists in the importuser.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3, which stems from the program's failure to validate file extensions. An attacker can...

ASUSTOR AS6202T ADM Path Traversal Vulnerability

ADM ASUSTOR Data Manager is the operating system and user interface for ASUSTOR NAS. A path traversal vulnerability exists in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3. An attacker can exploit this vulnerability to arbitrarily specify a file on the system to download via the file1 parameter...

ASUSTOR AS6202T ADM Directory Traversal Vulnerability

ADM ASUSTOR Data Manager is the operating system and user interface for ASUSTOR NAS. A directory traversal vulnerability exists in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3. An attacker can exploit this vulnerability to navigate the file system via the filename parameter...

ASUSTOR AS6202T ADM Insecure Direct Object Reference Vulnerability

ADM ASUSTOR Data Manager is the operating system and user interface for ASUSTOR NAS. An insecure direct object reference vulnerability exists in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3. An attacker could use this vulnerability to reference the "downloadsyssettings" action to arbitrarily...