513 matches found
CVE-2018-13332: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...
CVE-2018-13336: Improper Neutralization of Special Elements used in an OS Command
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation...
CVE-2018-13351: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...
CVE-2018-13331: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...
CVE-2018-13353: Improper Neutralization of Special Elements used in an OS Command
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...
CVE-2018-13329: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...
PT-2018-11773
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute commands by manipulating the checkport parameter. Recommendations For TerraMaster TOS version 3.1.03...
CVE-2018-13357: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names...
PT-2018-11812
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands via the newname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03, avoid using the newname parameter in the...
PT-2018-11782
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to enumerate system users. This is achieved through the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TOS version 3.1.03, consider restrictin...
CVE-2018-13338: Improper Neutralization of Special Elements used in an OS Command
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...
PT-2018-11781
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the filename URL parameter in the Text Editor, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, avo...
PT-2018-11776
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access control on the ajaxdata.php file, which allows attackers to elevate user permissions. Recommendations For TerraMaster TOS version 3.1.03, update to a version...
PT-2018-11761
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to control users' session cookies via JavaScript, potentially leading to session fixation in the web application. Recommendations For TerraMaster TOS version 3.1.03, conside...
PT-2018-11770
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute SQL queries via the Event parameter in the logtable.php file. This can potentially lead to unauthorized access to sensitive data. Recommendations For TerraMaster...
PT-2018-11762
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the username parameter during the user creation process...
PT-2018-11775
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access controls in the ajaxdata.php file, which allows attackers to create user groups without proper authorization. Recommendations For TerraMaster TOS version 3.1.0...
PT-2018-11772
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to view active session tokens in a world-readable directory, potentially exposing user sessions. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...
PT-2018-11760
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the pwd parameter during the user creation process...