308 matches found
Cross site scripting
Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...
CVE-2018-13333
Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames...
CVE-2018-13333
CVE-2018-13333 affects TerraMaster TOS File Manager in version 3.1.03. The issue is a cross-site scripting vulnerability that allows an attacker to execute JavaScript in a privileged permissions window by placing script in a user’s username. Some sources also frame this as a remote threat where a...
CVE-2018-13358
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter...
CVE-2018-13359
TerraMaster TOS 3.1.03 is affected by a cross-site scripting vulnerability in usertable.php via the modgroup parameter, enabling attacker-supplied JavaScript. NVD lists CVE-2018-13359 with CVSS v3 base score 8.8 (HIGH): NETWORK vector, LOW complexity, NONE privileges, UI required, and HIGH impact...
CVE-2018-13361
CVE-2018-13361 affects TerraMaster TOS version 3.1.03 (and related entries) via the endpoint in usertable.php , where the modgroup parameter enables an attacker to enumerate all system users. The vulnerability is described as allowing user listing, with no explicit exploitation details provided i...
CVE-2018-13337
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
CVE-2018-13337
CVE-2018-13337 affects TerraMaster TOS web application (version 3.1.03). The issue is a session fixation vulnerability that allows an attacker to control a user’s session cookies via JavaScript. Reported details from multiple sources corroborate a web-based session fixation path with low to moder...
CVE-2018-13350
SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter...
CVE-2018-13352
TerraMaster TOS (web app) version 3.1.03 is affected by CVE-2018-13352, enabling attackers to view active session tokens due to a session exposed in a world-readable directory. The issue is documented across multiple entries (NVD and CNVD) with a consistent description of session disclosure via i...
CVE-2018-13355
CVE-2018-13355 affects TerraMaster TOS 3.1.03; a flawed access control in ajaxdata.php allows attackers to create user groups without proper authorization. This undermines integrity and could enable privilege elevation within the system. No remediation or patch details are provided in the connect...
CVE-2018-13351
TerraMaster TOS 3.1.03 Control Panel contains a cross-site scripting vulnerability that allows attackers to execute JavaScript through the edit password form. The provided documents do not specify the vulnerable component version beyond 3.1.03, nor any patched remediation or available exploit det...
CVE-2018-13353
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...
CVE-2018-13336
CVE-2018-13336 : TerraMaster TOS 3.1.03 contains a system command injection in the Ajax request path ajaxdata.php used during user creation. The vulnerability is exploitable via the pwd parameter, enabling an attacker to execute arbitrary system commands. According to NVD metrics, the issue has a...
CVE-2018-13358
TerraMaster TOS 3.1.03 contains a command-injection flaw in ajaxdata.php via the checkName parameter, enabling remote execution of arbitrary commands and potential full system compromise as described in CVE-2018-13358. The vulnerability is corroborated by multiple advisories and CNVD/NVD records ...
CVE-2018-13418
TerraMaster TOS 3.1.03 contains a remote command injection in ajaxdata.php via the newname parameter, enabling attackers to execute system commands. This CVE (CVE-2018-13418) affects TerraMaster TOS versions
CVE-2018-13338
TerraMaster TOS 3.1.03 is affected by a remote command injection in ajaxdata.php during user creation. The vulnerability enables an attacker to execute arbitrary system commands by manipulating the username parameter. This is documented in CVE-2018-13338 and reiterated in multiple checks (NVD ent...
CVE-2018-13329
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...