PT-2018-11757

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript in the permissions window of the File Manager by injecting JavaScript into users' usernames, potentially leading to cross-site scripting attacks...

PT-2018-11759

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing shared folders via their descriptions, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS version 3.1.0...

PT-2018-11782

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to enumerate system users. This is achieved through the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TOS version 3.1.03, consider restrictin...

PT-2018-11779

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript, potentially leading to cross-site scripting. This is achieved via the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TO...

PT-2018-11774

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the logtable.php file, allowing attackers to execute system commands. This is achieved via the Event parameter. Recommendations For TerraMaster TOS versi...

PT-2018-11781

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the filename URL parameter in the Text Editor, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, avo...

PT-2018-11776

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access control on the ajaxdata.php file, which allows attackers to elevate user permissions. Recommendations For TerraMaster TOS version 3.1.03, update to a version...

PT-2018-11754

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands during group creation. This is achieved via the groupname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03...

PT-2018-11768

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the user's username in the web application taskbar, potentially leading to cross-site scripting attacks. Recommendations For TerraMaster TOS versio...

PT-2018-11758

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns cross-site scripting in the handle.php file, allowing attackers to execute JavaScript. This is achieved via the optionssysname parameter. Recommendations For TerraMaster TOS version...

CVE-2018-13336: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation...

PT-2018-11756

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to upload files to arbitrary locations via the "path" URL parameter in the explorer application. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

PT-2018-11771

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the edit password form in the Control Panel, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, updat...

PT-2018-11777

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster...

PT-2018-11761

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to control users' session cookies via JavaScript, potentially leading to session fixation in the web application. Recommendations For TerraMaster TOS version 3.1.03, conside...

PT-2018-11772

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to view active session tokens in a world-readable directory, potentially exposing user sessions. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

PT-2018-11753

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript code via the lines URL parameter in the ajaxdata.php file, potentially leading to cross-site scripting attacks. Recommendations For TerraMaster TOS...

CVE-2018-13355: Incorrect Permission Assignment for Critical Resource

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13354: Improper Neutralization of Special Elements used in an OS Command

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...

CVE-2018-13353: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...