Seagate NAS OS 4.3.15.1 - Open Redirect

Seagate NAS OS 4.3.15.1 contains an open redirect vulnerability in echo-server.html, which can allow an attacker to disclose information in the referer header via the state URL parameter. id: CVE-2018-12300 info: name: Seagate NAS OS 4.3.15.1 - Open Redirect author: 0xAkoko severity: medium...

Seagate NAS OS 4.3.15.1 - Server Information Disclosure

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. id: CVE-2018-12296 info: name: Seagate NAS OS 4.3.15.1 - Server Information...

Seagate BlackArmor NAS - Command Injection

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php. id: CVE-2014-3206 info: name: Seagate BlackArmor NAS - Command Injection author: gy741...

CVE-2025-9267

CVE-2025-9267 Description In Seagate Toolkit on Windows there is an insecure DLL-loading vulnerability in the Toolkit Installer prior to version 2.35.0.6 where the installer attempts to load DLLs from the current working directory without validating their origin or integrity. An attacker who can...

Seagate NAS OS Info Disclosure (CVE-2018-12296)

Exploits CVE-2018-12296 in Seagate NAS OS 4.3.15.1: unauthenticated POST to system.System.getinfos returns firmware version and serial number. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS getinfos disclosure CVE-2018-12296.""" from kittysploit import from...

Seagate Personal Cloud - getPhotoPlaylistPhotos LFI (CVE-2017-18263)

Detects CVE-2017-18263 by requesting /getPhotoPlaylistPhotos.psp?url=/etc/passwd and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud Media Server path traversal CVE-2017-18263.""" import re from kittysploit import from lib.protocols.http.httpclien...

Seagate BlackArmor NAS 220 - localJob.php RCE Detection

Detects command injection in /backupmgt/localJob.php?session=fail;++file%00 on Seagate BlackArmor NAS 220 Greenbone Jul 2021 active check. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate BlackArmor NAS 220 backupmgt localJob.php command injection.""" import re import secrets from kittysploit...

Seagate BlackArmor NAS 220 - localJob.php Command Injection

Exploits command injection in /backupmgt/localJob.php on Seagate BlackArmor NAS 220 by appending OS commands after session=fail and reading stdout from /backupmgt/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate BlackArmor NAS 220 backupmgt localJob.php...

Seagate Personal Cloud - File Read (CVE-2017-18263)

Reads arbitrary files via CVE-2017-18263 getPhotoPlaylistPhotos.psp?url= path. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud getPhotoPlaylistPhotos file read CVE-2017-18263.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Seagate NAS OS 4.3.15.1 - Open Redirect Detection

Seagate NAS OS 4.3.15.1 contains an open redirect vulnerability in echo-server.html, which can allow an attacker to disclose information in the referer header via the state URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS 4.""" import re from kittysploit import from...

Seagate NAS Login - Detect

Seagate NAS - SEAGATE Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS - SEAGATE Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seagate NAS Login - Detect',...

Seagate NAS OS 4.3.15.1 - Server Information Disclosure Detection

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS version 4.""" from...

CVE-2026-10719

Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte...

EUVD-2026-34043

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation...

CVE-2026-10718

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation...

CVE-2026-10719

Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte...

CVE-2026-10719

CVE-2026-10719 affects Seagate’s openSeaChest/Seachest (v25.05.3). The issue is an out-of-bounds write in openSeaChest’s --showSupportedFormats, permitting writing one extra byte past allocated memory when a malicious NVMe device with a bogus FLBAS value in the namespace is processed. As describe...

CVE-2026-10718

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation...

CVE-2026-10718 Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation...

CVE-2026-10718

CVE-2026-10718 affects Seagate’s openSeaChest (v26.03.0) and is triggered by the Trim/Unmap operation. The root cause is an out-of-bounds write that allows writing extra memory describing a range of LBAs to deallocate, extending 16 bytes outside the allocated space across all supported platforms....