CVE-2018-12302

CVE-2018-12302 concerns Seagate NAS OS web application (v4.3.15.1) with missing HttpOnly flag on session cookies, enabling potential theft of session tokens via cross-site scripting. Publicly surfaced details are consistent across sources (NVD/Red Hat/other catalogs). The Red Hat and NVD entries ...

CVE-2018-12302

Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting...

CVE-2018-12301

CVE-2018-12301 affects Seagate NAS OS v4.3.15.1: Unvalidated URL in the Download Manager allows access to the loopback interface via a Download URL of 127.0.0.1 or localhost. Connected sources (Red Hat advisory, NVD entry, CVE listing) confirm the same description, but do not provide exploit deta...

CVE-2018-12301

Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost...

CVE-2018-12300

Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...

CVE-2018-12300

CVE-2018-12300 refers to an open redirect in Seagate NAS OS 4.3.15.1, specifically in echo-server.html, enabling an attacker to disclose information in the Referer header via the state URL parameter. Connected sources (Nuclei template) confirm the open redirect description and name the affected d...

CVE-2018-12299

CVE-2018-12299 relates to a cross-site scripting (XSS) vulnerability in Seagate NAS OS 4.3.15.1 filebrowser. The issue arises because uploaded file names can trigger JavaScript execution in the browser, enabling an attacker to perform actions in a victim’s session. The available connected documen...

CVE-2018-12299

Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names...

CVE-2018-12298

Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path...

CVE-2018-12298

CVE-2018-12298: Directory traversal in Seagate NAS OS filebrowser (v4.3.15.1) allows reading files inside the app container via crafted URL paths. Root cause appears to be improper URL path handling. Affects filebrowser component; impact includes partial confidentiality (C in CVSS). CVSS data pre...

CVE-2018-12297

CVE-2018-12297 affects Seagate NAS OS 4.3.15.1 with XSS in API error pages via URL path names. Root cause cited as insufficient validation of client data by the WEB application; impact is client-side script execution. Exploitation details/works are not provided in the documents; no remediation/ve...

CVE-2018-12297

Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...

CVE-2018-12296

Insufficient access control in /api/external/7.0/system.System.getinfos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests...

CVE-2018-12296

CVE-2018-12296 affects Seagate NAS OS 4.3.15.1. The issue is insufficient access control on the API endpoint /api/external/7.0/system.System.get_infos, permitting an unauthenticated attacker to obtain information about the NAS via empty POST requests. The NVD and connected templates describe this...

CVE-2018-12295

The CVE describes a SQL injection in folderViewSpecific.psp of Seagate NAS OS v4.3.15.1, allowing attackers to execute arbitrary SQL commands through the dirId URL parameter. Affected software is Seagate NAS OS (version 4.3.15.1); root cause is improper handling of the dirId parameter in folderVi...

CVE-2018-12295

SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter...

Netatalk < 3.1.12 - Authentication Bypass Exploit

Exploit Title: Netatalk Authentication Bypass Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS x8664 CVE : CVE-2018-1160 Advisory:...

Netatalk 3.1.12 - Authentication Bypass

Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS x8664 CVE : CVE-2018-1160 Advisory:...

Netatalk Authentication Bypass

Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS x8664 CVE : CVE-2018-1160 Advisory:...

Netatalk 3.1.12 - Authentication Bypass

Netatalk 3.1.12 - Authentication Bypass Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS...