CVE-2018-12318

Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext...

CVE-2018-12309

Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345...

CVE-2018-12316

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

CVE-2018-12307

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter...

CVE-2018-12306

CVE-2018-12306 describes a directory traversal vulnerability in ASUSTOR ADM’s File Explorer (v3.1.1). An attacker can view arbitrary files by altering the URL parameter file1, indicating improper input handling in the file-path logic. The vulnerability is presented as analogous to CVE-2018-11344....

CVE-2018-12311

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...

CVE-2018-12314

ASUSTOR ADM 3.1.1 is affected by a directory traversal vulnerability in downloadwallpaper.cgi. The issue allows an attacker to download arbitrary files by manipulating the file and folder URL parameters. This is documented in CVE-2018-12314 (NVD entry) and corroborated by CNVD-2018-25182, which d...

CVE-2018-12315

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

CVE-2018-12314

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

CVE-2018-12319

Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title...

ASUSTOR ADM 3.1 scope SQL Injection

SQL Injection vulnerability in ASUSTOR ADM scope parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ASUSTOR ADM 3.1 album_id SQL Injection

SQL Injection vulnerability in ASUSTOR ADM albumid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

ASUSTOR ADM <= 3.0.5.RDU1 Authentication Bypass Vulnerability - Active Check

ASUSTOR ADM is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if...

ASUSTOR NAS ADM Login Bypass Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS with a tablet-like graphical interface comparable to a zero learning curve. A login bypass vulnerability exists in ASUSTOR NAS ADM. The vulnerability exists in the web interface of the ASUSTOR NAS, where /initial/index.cgi is...

ASUSTOR Data Master Information Disclosure Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. An information disclosure vulnerability exists in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker can exploit this vulnerability by sending a request to the loginimage.cgi file to read...

ASUSTOR Data Master Account Enumeration Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A security vulnerability exists in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker can exploit this vulnerability to enumerate all accounts on the device with the help of the user.cgi...

ASUSTOR ADM < 3.1.6 Multiple Vulnerabilities

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

ASUSTOR Data Master Path Traversal Vulnerability (CNVD-2018-17897)

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A path traversal vulnerability exists in ASUSTOR ADM 3.1.5 and prior versions. A remote attacker can exploit this vulnerability to upload files to an arbitrary location and potentially execute co...

ASUSTOR Data Master File Disclosure Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A file disclosure vulnerability exists in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker can exploit this vulnerability by sending a request to the downloadwallpaper.cgi file and...

ASUSTOR Data Master Path Traversal Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A path traversal vulnerability exists in the wallpaper.cgi file in ASUSTOR ADM 3.1.5 and earlier versions. A remote attacker could exploit this vulnerability to delete arbitrary files on the file...