CVE-2018-13322

Directory traversal in listfolders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter...

CVE-2018-13324

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

CVE-2018-13321

CVE-2018-13321 affects Buffalo TS5600D1206 NAS devices (nasapi) with version 3.61-0.10. Root cause: incorrect access controls that let an attacker invoke dangerous internal functions via the method parameter. Documented impact indicates high severity (CVSS3: 8.8; confidentiality, integrity, and a...

CVE-2018-13323

CVE-2018-13323 affects Buffalo TS5600D1206 (version 3.61-0.10). The vulnerability is a cross-site scripting flaw in the detail.html page that allows an attacker to run JavaScript via the username cookie , as documented in multiple sources. The NVD entry describes a standard XSS where the cookie v...

CVE-2018-13324

Buffalo TS5600D1206 NAS firmware (version 3.61-0.10) contains an authentication bypass in nasapi. The root cause is improper access control that allows an attacker to bypass login by sending a modified HTTP Host header. Public references in the connected documents corroborate this vulnerability a...

CVE-2018-13322

Buffalo TS5600D1206 (firmware 3.61-0.10) is affected by CVE-2018-13322 due to a directory traversal vulnerability in the list_folders function. The issue allows an attacker to list directory contents by supplying a crafted path parameter. CVSS information in the initial record indicates a network...

CVE-2018-13320

Buffalo TS5600D1206 (firmware version 3.70-0.10) contains a Command Injection vulnerability in the network.set_auth_settings function. The issue allows an attacker to trigger system commands via the adminUsername and adminPassword parameters, enabling potential remote command execution over a net...

CVE-2018-13323

Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie...

CVE-2018-13319

CVE-2018-13319 concerns Buffalo TS5600D1206 firmware, affected in version 3.61-0.10, where an incorrect access control in get_portal_info permits an unauthenticated POST request to disclose sensitive device information. This vulnerability represents an information disclosure risk due to insuffici...

PT-2018-11748

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue is related to incorrect access control in the nasapi, allowing attackers to bypass authentication. This can be achieved by sending a modified HTTP Host header. Recommendations For...

CVE-2018-13318: Improper Neutralization of Special Elements used in an OS Command

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

CVE-2018-13322: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in listfolders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter...

CVE-2018-13324: Incorrect Authorization

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

CVE-2018-13320: Improper Neutralization of Special Elements used in an OS Command

System Command Injection in network.setauthsettings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters...

CVE-2018-13321: Incorrect Permission Assignment for Critical Resource

Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter...

PT-2018-11745

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue is related to incorrect access controls in the nasapi, allowing attackers to call internal functions. This can be achieved by manipulating the method parameter. Recommendations For...

PT-2018-11741

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue concerns system command injection in the User.create method, allowing attackers to execute system commands via the name parameter. Recommendations For Buffalo TS5600D1206 version...

PT-2018-11744

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.70-0.10 Description The issue allows attackers to execute system commands via the adminUsername and adminPassword parameters in the network.set auth settings function. Recommendations For Buffalo TS5600D1206 versi...

PT-2018-11742

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue allows attackers to determine sensitive device information via an unauthenticated POST request due to incorrect access control in the get portal info function. Recommendations For...

CVE-2018-13319: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect access control in getportalinfo in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request...