533 matches found
CVE-2018-12311
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...
Information disclosure
Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext...
Directory traversal
Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...
CVE-2018-12310
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature...
CVE-2018-12312
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secretkey" URL parameter...
Cross site scripting
Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...
CVE-2018-12305
Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...
CVE-2018-12308
Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...
CVE-2018-12313
CVE-2018-12313 affects ASUSTOR ADM 3.1.1: OS command injection in snmp.cgi exploitable without authentication via the rocommunity parameter. Impact: remote code execution with high integrity/availability risk (CVSSv3/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8). Affected component: snmp.cgi in ADM;...
CVE-2018-12310
CVE-2018-12310 describes a cross-site scripting vulnerability in ASUSTOR ADM (login page, version 3.1.1) where an attacker can inject JavaScript through the System Announcement feature. Affected component: ASUSTOR ADM login flow. Underlying issue: stored/reflected XSS in the login surface (detail...
CVE-2018-12305
The provided connected sources confirm a Cross-site scripting vulnerability in ASUSTOR ADM 3.1.1 File Explorer. Specifically, uploading SVG images with embedded JavaScript allows an attacker to execute code. Affected product: ASUSTOR ADM (File Explorer component) version 3.1.1. Root cause: improp...
CVE-2018-12309
CVE-2018-12309 describes a directory traversal in ASUSTOR ADM 3.1.1, via upload.cgi, allowing an attacker to upload files to arbitrary locations by modifying the path URL parameter (the filename parameter is covered by CVE-2018-11345). NVD lists CVSS v3.0 base score 7.5 (HIGH) with network attack...
CVE-2018-12318
CVE-2018-12318 relates to ASUSTOR ADM (versions including 3.1.1) where the SNMP settings page leaks the SNMP password in plaintext. The CVE is documented in multiple sources (NVD and CNVD entries) with the same basic impact: information disclosure. The root cause is an information disclosure flaw...
CVE-2018-12311
ASUSTOR ADM File Explorer (v3.1.1) is affected by a cross-site scripting vulnerability. When a file is moved using a malicious filename, an attacker can cause arbitrary JavaScript execution. The reports do not provide specific fixes or patch versions in the supplied documents.
CVE-2018-12307
ASUSTOR ADM version 3.1.1 is affected by an OS command injection in the user.cgi component. The vulnerability allows an attacker to execute system commands as root via the name POST parameter, enabling full compromise of the device. Descriptions across multiple feeds (NVD/NVD family and CNVD) con...
CVE-2018-12306
Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...
CVE-2018-12308
ASUSTOR ADM 3.1.1 is affected by an information disclosure in share.cgi that allows an attacker to obtain the encryption key via the encrypt_key URL parameter. The root cause is a flaw in how share.cgi handles the key, enabling unauthorized access to the encryption key and potential compromise of...
CVE-2018-12319
CVE-2018-12319 affects ASUSTOR ADM 3.1.1. The Available connected documents describe a Denial-of-Service on the login page caused by placing malformed text in the login page title, preventing users from signing in. The vulnerability impact is partial availability loss (DoS) with a high CVSS 3.0 b...
CVE-2018-12316
ASUSTOR ADM is affected by OS Command Injection in upload.cgi in version 3.1.1, where an attacker can modify the filename POST parameter to execute system commands. This is documented across multiple sources (NVD CVE-2018-12316, CNVD-2018-25181, OpenVAS entry) with a CVSS base score high (3.0: 8....