CVE-2018-12314

ASUSTOR ADM 3.1.1 is affected by a directory traversal vulnerability in downloadwallpaper.cgi. The issue allows an attacker to download arbitrary files by manipulating the file and folder URL parameters. This is documented in CVE-2018-12314 (NVD entry) and corroborated by CNVD-2018-25182, which d...

CVE-2018-12315: Weak Password Recovery Mechanism for Forgotten Password

Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password...

CVE-2018-12316: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter...

CVE-2018-12311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...

CVE-2018-12318: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext...

CVE-2018-12308: Exposure of Sensitive Information to an Unauthorized Actor

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...

CVE-2018-12314: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

CVE-2018-12307: Improper Neutralization of Special Elements used in an OS Command

OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter...

PT-2018-11105

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root via the name POST parameter in the user.cgi module. This can be exploited by sending a malicious POST request to the vulnerable endpoint...

PT-2018-11104

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description A directory traversal issue in the File Explorer component allows attackers to view arbitrary files by modifying the file1 URL parameter. This issue is similar to a previously known problem. Recommendation...

PT-2018-11113

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to download arbitrary files by manipulating the file and folder URL parameters in the downloadwallpaper.cgi. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting...

PT-2018-11110

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description A cross-site scripting issue in File Explorer allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename. Recommendations For ASUSTOR ADM version 3.1.1, consider renamin...

PT-2018-11118

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description A denial-of-service issue exists in the login page, allowing attackers to prevent users from signing in by placing malformed text in the title. Recommendations For ASUSTOR ADM version 3.1.1, update to a...

SQL Injection Vulnerability in HuCart adm***.php Page

HuCart HuCart is an open source enterprise building system. HuCart 5.7.4 version adm.php page SQL injection vulnerability , remote attackers can exploit the vulnerability to obtain database sensitive information...

PT-2018-11111

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands as root via the secret key URL parameter in the user.cgi module. Recommendations For ASUSTOR ADM version 3.1.1, avoid using the secret key parameter in...

PT-2018-11117

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to obtain the SNMP password in cleartext due to information disclosure in the SNMP settings page. Recommendations For ASUSTOR ADM version 3.1.1, consider restricting access to th...

CVE-2018-12313: Improper Neutralization of Special Elements used in an OS Command

OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter...

PT-2018-11112

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description The issue allows attackers to execute system commands without authentication. This is achieved via the rocommunity URL parameter in the snmp.cgi module. Recommendations For ASUSTOR ADM version 3.1.1,...

CVE-2018-12305: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript...

CVE-2018-12317: Improper Neutralization of Special Elements used in an OS Command

OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter...