CVE-2018-13358: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter...

CVE-2018-13334: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

CVE-2018-13332: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...

CVE-2018-13333: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames...

CVE-2018-13360: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

CVE-2018-13357: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names...

CVE-2018-13352: Exposure of Sensitive Information to an Unauthorized Actor

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

PT-2018-11781

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript via the filename URL parameter in the Text Editor, potentially leading to cross-site scripting. Recommendations For TerraMaster TOS version 3.1.03, avo...

PT-2018-11777

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster...

CVE-2018-13329: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter...

CVE-2018-13338: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...

PT-2018-11756

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to upload files to arbitrary locations via the "path" URL parameter in the explorer application. Recommendations For TerraMaster TOS version 3.1.03, consider restricting...

TerraMaster TOS Unauthenticated Remote Command Execution

Vulnerability Summary The following advisory describes a unauthenticated remote command execution found in TerraMaster TOS 3.0.33. TOS is a “Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.”...

TerraMaster TOS < 3.0.34 RCE Vulnerability - Active Check

TerraMaster TOS is prone to a remote command execution RCE vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

TerraMaster TOS shell metacharacter injection vulnerability

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. A security vulnerability exists in the /usr/www/include/ajax/GetTest.php file in...

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

Design/Logic Flaw

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root...

CVE-2017-9328

CVE-2017-9328 affects TerraMaster TOS prior to 3.0.34. The vulnerability is a shell metacharacter injection in /usr/www/include/ajax/GetTest.php that enables remote code execution as root. Affected product: TerraMaster TOS (Linux-based). Root RCE is possible via crafted input through GetTest.php....