440 matches found
CVE-2018-13361
User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...
CVE-2018-13360
TerraMaster TOS 3.1.03 Text Editor is vulnerable to cross-site scripting via the filename URL parameter, enabling an attacker to inject and execute JavaScript. This is documented in CVE-2018-13360 and corroborated by CNVD/NVD entries and related OpenVAS data, all indicating the issue centers on t...
CVE-2018-13350
CVE-2018-13350 —TerraMaster TOS 3.1.03 is affected by an SQL injection in the logtable.php file, exploitable via the Event parameter. This vulnerability allows execution of SQL queries and is described in multiple sources, including the NVD entry. The connected documents provide the vulnerable co...
CVE-2018-13349
CVE-2018-13349 is described as a cross-site scripting (XSS) vulnerability in the TerraMaster TOS web application taskbar for version 3.1.03. The issue allows an attacker to execute JavaScript via the user’s username. The connected documents corroborate XSS in TerraMaster TOS 3.1.03, but no explic...
CVE-2018-13349
Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username...
CVE-2018-13356
CVE-2018-13356 affects TerraMaster TOS 3.1.03 . The vulnerability is described as an improper access control in the file ajaxdata.php , enabling attackers to elevate user permissions . From the provided data, the CVSSv3 base score is 8.8 (HIGH) with Network attack vector, LOW attack complexity, a...
CVE-2018-13357
CVE-2018-13357 is an XSS in TerraMaster TOS 3.1.03. The vulnerability lies in the Control Panel where JavaScript can be executed when viewing Shared Folders, via the names of Shared Folders. Affected product/component: TerraMaster TOS Control Panel / Shared Folders naming. Impact: attacker can in...
CVE-2018-13357
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names...
CVE-2018-13352
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...
CVE-2018-13353
TerraMaster TOS 3.1.03 contains a command injection vulnerability in ajaxdata.php via the checkport parameter. The issue allows an attacker to execute arbitrary commands, as indicated by CVE-2018-13353 with high severity (CVSS v3.0 base 8.8). The connected documents confirm the affected endpoint ...
CVE-2018-13354
TerraMaster TOS 3.1.03 is affected by a system command injection in logtable.php exposed via the Event parameter, enabling an attacker to execute arbitrary commands. Multiple sources (NVD, CNVD, OpenVAS, PRION, CVELIST) corroborate that the flaw is reachable remotely (network) with high/critical ...
CVE-2018-13334
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...
CVE-2018-13329
CVE-2018-13329 concerns TerraMaster TOS (version 3.1.03) where the endpoint ajaxdata.php is vulnerable to cross-site scripting (XSS) via the lines URL parameter. The described impact is that remote attackers can cause JavaScript execution in the context of a user session. The connected documents ...
CVE-2018-13329
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...
CVE-2018-13337
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
CVE-2018-13329
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...
CVE-2018-13337
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
Cross site scripting
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...