CVE-2018-13354: Improper Neutralization of Special Elements used in an OS Command

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...

CVE-2018-13350: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter...

CVE-2018-13355: Incorrect Permission Assignment for Critical Resource

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

PT-2018-11812

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands via the newname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03, avoid using the newname parameter in the...

PT-2018-11778

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the checkName parameter. Recommendations For TerraMaster TOS...

PT-2018-11776

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access control on the ajaxdata.php file, which allows attackers to elevate user permissions. Recommendations For TerraMaster TOS version 3.1.03, update to a version...

PT-2018-11759

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing shared folders via their descriptions, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS version 3.1.0...

PT-2018-11755

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS...

PT-2018-11754

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands during group creation. This is achieved via the groupname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03...

CVE-2018-13359: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...

PT-2018-11756

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to upload files to arbitrary locations via the "path" URL parameter in the explorer application. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

PT-2018-11774

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the logtable.php file, allowing attackers to execute system commands. This is achieved via the Event parameter. Recommendations For TerraMaster TOS versi...

CVE-2018-13349: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username...

CVE-2018-13337: Session Fixation

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13353: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...

CVE-2018-13351: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...

CVE-2018-13356: Incorrect Authorization

Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions...

CVE-2018-13418: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter...

CVE-2018-13361: Improper Input Validation

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13336: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation...