CVE-2018-13335

CVE-2018-13335 affects TerraMaster TOS 3.1.03: Cross-site scripting in the Control Panel enables crafted folder descriptions to inject JavaScript when viewing shared folders. The information in the NVD entry and related advisories confirms the vulnerable component (Control Panel) and the nature o...

CVE-2018-13357

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names...

CVE-2018-13351

TerraMaster TOS 3.1.03 Control Panel contains a cross-site scripting vulnerability that allows attackers to execute JavaScript through the edit password form. The provided documents do not specify the vulnerable component version beyond 3.1.03, nor any patched remediation or available exploit det...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

Cross site scripting

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

Session fixation

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

Cross site scripting

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13329

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

PT-2018-11773

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute commands by manipulating the checkport parameter. Recommendations For TerraMaster TOS version 3.1.03...

PT-2018-11762

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the username parameter during the user creation process...

PT-2018-11775

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access controls in the ajaxdata.php file, which allows attackers to create user groups without proper authorization. Recommendations For TerraMaster TOS version 3.1.0...

PT-2018-11760

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the pwd parameter during the user creation process...

CVE-2018-13333: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames...

PT-2018-11812

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands via the newname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03, avoid using the newname parameter in the...

PT-2018-11778

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the checkName parameter. Recommendations For TerraMaster TOS...

PT-2018-11755

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS...