432 matches found
CVE-2018-13334
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...
CVE-2018-13330
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter...
CVE-2018-13354
System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...
CVE-2018-13360
Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...
CVE-2018-13329
CVE-2018-13329 concerns TerraMaster TOS (version 3.1.03) where the endpoint ajaxdata.php is vulnerable to cross-site scripting (XSS) via the lines URL parameter. The described impact is that remote attackers can cause JavaScript execution in the context of a user session. The connected documents ...
CVE-2018-13330
TerraMaster TOS 3.1.03 is affected by a system command injection in ajaxdata.php during group creation via the groupname parameter. The vulnerability allows an attacker to execute system commands on the device. Connected advisories (CNVD-2019-00661, NVD CVE-2018-13330, PRION-CVE-2018-13330, OpenV...
CVE-2018-13331
CVE-2018-13331 affects TerraMaster TOS (Control Panel) with version 3.1.03. The vulnerability is a cross-site scripting flaw that lets an attacker cause JavaScript execution by placing script code in usernames when viewing user pages. This is described in multiple sources referencing the TerraMas...
CVE-2018-13332
CVE-2018-13332 concerns TerraMaster TOS. The connected documents confirm a directory traversal vulnerability in the explorer application of TerraMaster TOS version 3.1.03, which can be exploited to upload files to arbitrary locations via the URL parameter. The CVSS data provided indicates a high...
CVE-2018-13333
CVE-2018-13333 affects TerraMaster TOS File Manager in version 3.1.03. The issue is a cross-site scripting vulnerability that allows an attacker to execute JavaScript in a privileged permissions window by placing script in a user’s username. Some sources also frame this as a remote threat where a...
CVE-2018-13352
TerraMaster TOS (web app) version 3.1.03 is affected by CVE-2018-13352, enabling attackers to view active session tokens due to a session exposed in a world-readable directory. The issue is documented across multiple entries (NVD and CNVD) with a consistent description of session disclosure via i...
CVE-2018-13351
TerraMaster TOS 3.1.03 Control Panel contains a cross-site scripting vulnerability that allows attackers to execute JavaScript through the edit password form. The provided documents do not specify the vulnerable component version beyond 3.1.03, nor any patched remediation or available exploit det...
CVE-2018-13418
TerraMaster TOS 3.1.03 contains a remote command injection in ajaxdata.php via the newname parameter, enabling attackers to execute system commands. This CVE (CVE-2018-13418) affects TerraMaster TOS versions
CVE-2018-13338
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...
CVE-2018-13358
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter...
CVE-2018-13349
Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username...
CVE-2018-13349
CVE-2018-13349 is described as a cross-site scripting (XSS) vulnerability in the TerraMaster TOS web application taskbar for version 3.1.03. The issue allows an attacker to execute JavaScript via the user’s username. The connected documents corroborate XSS in TerraMaster TOS 3.1.03, but no explic...
CVE-2018-13338
TerraMaster TOS 3.1.03 is affected by a remote command injection in ajaxdata.php during user creation. The vulnerability enables an attacker to execute arbitrary system commands by manipulating the username parameter. This is documented in CVE-2018-13338 and reiterated in multiple checks (NVD ent...
CVE-2018-13337
CVE-2018-13337 affects TerraMaster TOS web application (version 3.1.03). The issue is a session fixation vulnerability that allows an attacker to control a user’s session cookies via JavaScript. Reported details from multiple sources corroborate a web-based session fixation path with low to moder...
CVE-2018-13335
CVE-2018-13335 affects TerraMaster TOS 3.1.03: Cross-site scripting in the Control Panel enables crafted folder descriptions to inject JavaScript when viewing shared folders. The information in the NVD entry and related advisories confirms the vulnerable component (Control Panel) and the nature o...