Seagate BlackArmor NAS - Multiple Vulnerabilities

Seagate BlackArmor NAS - Multiple Vulnerabilities Exploit Title: Seagate BlackArmor NAS Multiple Vulnerabilities Date: 2/17/14 Exploit Author: Shayan Sadigh twitter.com/r1pplex | Vendor Homepage: http://www.seagate.com/external-hard-drives/network-storage/ Version: All BlackArmor NAS devices...

Seagate BlackArmor NAS - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: Seagate BlackArmor NAS Multiple Vulnerabilities Date: 2/17/14 Exploit Author: Shayan Sadigh twitter.com/r1pplex | Vendor Homepage: http://www.seagate.com/external-hard-drives/network-storage/ Version: All BlackArmor NAS...

Seagate BlackArmor NAS - Multiple Vulnerabilities

Exploit Title: Seagate BlackArmor NAS Multiple Vulnerabilities Date: 2/17/14 Exploit Author: Shayan Sadigh twitter.com/r1pplex | Vendor Homepage: http://www.seagate.com/external-hard-drives/network-storage/ Version: All BlackArmor NAS devices.. Tested on: Linux CVE : N/A 1. some sort of backdoor...

CVE-2013-3069

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

CVE-2013-3069

Multiple cross-site scripting XSS vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject arbitrary web script or HTML via the 1 UserName or 2 Password to the NAS User Setup page, 3 deviceName to USBadvanced.htm, or 4 Network Key to the Wireless Setup...

CVE-2013-3069

CVE-2013-3069 concerns multiple XSS flaws in NETGEAR WNDR4700 firmware 1.0.0.34. The vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML through four vectors: (1) UserName or (2) Password on the NAS User Setup page, (3) deviceName on USB_advanced.htm, and (4) N...

FreeBSD : nas -- multiple vulnerabilities (bf7912f5-c1a8-11e3-a5ac-001b21614864)

Hamid Zamani reports : multiple security problems buffer overflows, format string vulnerabilities and missing input sanitising, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Synology DiskStation Manager跨站脚本漏洞

Bugtraq ID:66504 Synology DiskStation Manager是第一个提供网络多任务处理用户接口的NAS操作系统。 远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Synology DiskStation Manager 5.x Synology DiskStation Manager 5.0-4458 Update 1版本已修复该漏洞，建议用户下载使用： http://www.synology.com...

Thecus NAS Server N8800 get_userid OS命令注入漏洞

CVECAN ID: CVE-2013-5667 Thecus NAS server N8800是一款网络接入服务器设备。 Thecus NAS server N8800（固件版本5.03.01）在实现上存在安全漏洞，远程攻击者通过用户名参数内包含元字符的getuserid操作，利用此漏洞可执行任意命令。 0 thecus NAS Server N8800 5.03.01 厂商补丁： thecus ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.thecus.com/...

Thecus NAS Server N8800信息泄露漏洞

CVECAN ID: CVE-2013-5669 Thecus NAS server N8800是一款网络接入服务器设备。 Thecus NAS server N8800（固件版本5.03.01）对管理员身份验证使用了纯文本的凭证，这可使远程攻击者通过嗅探网络获取敏感信息。 0 thecus NAS Server N8800 5.03.01 厂商补丁： thecus ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.thecus.com/ http://www.7elements.co.uk/news/cve-2013-5669...

Thecus NAS Server N8800 ADS/NT Support凭证泄露漏洞

CVECAN ID: CVE-2013-5668 Thecus NAS server N8800是一款网络接入服务器设备。 Thecus NAS server N8800（固件版本5.03.01）的ADS/NT Support页面上在实现上存在安全漏洞，远程攻击者通过读取该页的纯文本内容，利用此漏洞可获取管理员凭证。 0 thecus NAS Server N8800 5.03.01 厂商补丁： thecus ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.thecus.com/...

CVE-2013-5668

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content...

CVE-2013-5669

The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-5667

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a getuserid action with shell metacharacters in the username parameter...

Code injection

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content...

Design/Logic Flaw

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a getuserid action with shell metacharacters in the username parameter...

Design/Logic Flaw

The Thecus NAS server N8800 with firmware 5.03.01 uses cleartext credentials for administrative authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-5667

The Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to execute arbitrary commands via a getuserid action with shell metacharacters in the username parameter...

CVE-2013-5668

The ADS/NT Support page on the Thecus NAS server N8800 with firmware 5.03.01 allows remote attackers to discover the administrator credentials by reading this page's cleartext content...