Session fixation

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13329

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

PT-2018-11773

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute commands by manipulating the checkport parameter. Recommendations For TerraMaster TOS version 3.1.03...

PT-2018-11757

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript in the permissions window of the File Manager by injecting JavaScript into users' usernames, potentially leading to cross-site scripting attacks...

PT-2018-11753

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript code via the lines URL parameter in the ajaxdata.php file, potentially leading to cross-site scripting attacks. Recommendations For TerraMaster TOS...

PT-2018-11761

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to control users' session cookies via JavaScript, potentially leading to session fixation in the web application. Recommendations For TerraMaster TOS version 3.1.03, conside...

PT-2018-11770

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute SQL queries via the Event parameter in the logtable.php file. This can potentially lead to unauthorized access to sensitive data. Recommendations For TerraMaster...

PT-2018-11771

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the edit password form in the Control Panel, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, updat...

PT-2018-11775

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access controls in the ajaxdata.php file, which allows attackers to create user groups without proper authorization. Recommendations For TerraMaster TOS version 3.1.0...

PT-2018-11782

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to enumerate system users. This is achieved through the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TOS version 3.1.03, consider restrictin...

PT-2018-11762

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the username parameter during the user creation process...

PT-2018-11756

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to upload files to arbitrary locations via the "path" URL parameter in the explorer application. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

PT-2018-11768

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the user's username in the web application taskbar, potentially leading to cross-site scripting attacks. Recommendations For TerraMaster TOS versio...

PT-2018-11760

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns system command injection in the ajaxdata.php file, allowing attackers to execute system commands. This is achieved via the pwd parameter during the user creation process...

PT-2018-11758

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue concerns cross-site scripting in the handle.php file, allowing attackers to execute JavaScript. This is achieved via the optionssysname parameter. Recommendations For TerraMaster TOS version...

PT-2018-11772

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to view active session tokens in a world-readable directory, potentially exposing user sessions. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

PT-2018-11779

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript, potentially leading to cross-site scripting. This is achieved via the modgroup parameter in the usertable.php file. Recommendations For TerraMaster TO...

PT-2018-11781

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the filename URL parameter in the Text Editor, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, avo...