440 matches found
CVE-2018-13353
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...
CVE-2018-13361
CVE-2018-13361 affects TerraMaster TOS version 3.1.03 (and related entries) via the endpoint in usertable.php , where the modgroup parameter enables an attacker to enumerate all system users. The vulnerability is described as allowing user listing, with no explicit exploitation details provided i...
CVE-2018-13330
TerraMaster TOS 3.1.03 is affected by a system command injection in ajaxdata.php during group creation via the groupname parameter. The vulnerability allows an attacker to execute system commands on the device. Connected advisories (CNVD-2019-00661, NVD CVE-2018-13330, PRION-CVE-2018-13330, OpenV...
CVE-2018-13334
TerraMaster TOS
CVE-2018-13332
CVE-2018-13332 concerns TerraMaster TOS. The connected documents confirm a directory traversal vulnerability in the explorer application of TerraMaster TOS version 3.1.03, which can be exploited to upload files to arbitrary locations via the URL parameter. The CVSS data provided indicates a high...
CVE-2018-13331
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...
CVE-2018-13338
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...
CVE-2018-13360
Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...
CVE-2018-13359
Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...
CVE-2018-13351
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...
CVE-2018-13355
Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...
CVE-2018-13356
Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions...
CVE-2018-13354
System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...
CVE-2018-13335
CVE-2018-13335 affects TerraMaster TOS 3.1.03: Cross-site scripting in the Control Panel enables crafted folder descriptions to inject JavaScript when viewing shared folders. The information in the NVD entry and related advisories confirms the vulnerable component (Control Panel) and the nature o...
CVE-2018-13330
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter...
CVE-2018-13335
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions...
CVE-2018-13331
CVE-2018-13331 affects TerraMaster TOS (Control Panel) with version 3.1.03. The vulnerability is a cross-site scripting flaw that lets an attacker cause JavaScript execution by placing script code in usernames when viewing user pages. This is described in multiple sources referencing the TerraMas...
CVE-2018-13332
Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...