Design/Logic Flaw

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

CVE-2018-11341

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter...

CVE-2018-11344

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

Path traversal

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

Unrestricted file upload

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

CVE-2018-11340

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed...

CVE-2018-11346

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "downloadsyssettings" action and then specify files arbitrarily throughout the system via the act parameter...

CVE-2018-11342

CVE-2018-11342 describes a path traversal flaw in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically in the fileExplorer.cgi component. An attacker can exploit the dest_folder parameter to specify arbitrary file system paths and create folders, potentially impacting confidentiality and integrity of the...

CVE-2018-11344

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...

CVE-2018-11346

CVE-2018-11346 affects ASUSTOR NAS model AS6202T running ADM 3.1.0.RFQ3. The vulnerability is an insecure direct object reference in download.cgi that can reference the action "download_sys_settings" and then specify arbitrary files across the system via the act parameter. The provided documents ...

CVE-2018-11345

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is...

CVE-2018-11342

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

CVE-2018-11344

CVE-2018-11344 concerns ASUSTOR ADM 3.1.0.RFQ3 on AS6202T. A path traversal vulnerability in download.cgi via the file1 parameter allows an attacker to download arbitrary files from the system. Affected component: download.cgi; root cause: improper validation of file paths in file1. Proof of impa...

CVE-2018-11345

ASUSTOR AS6202T ADM 3.1.0.RFQ3 is affected by CVE-2018-11345: an unrestricted file upload vulnerability in upload.cgi that allows uploading data via the POST parameter filename and, due to path traversal in that parameter, placing files anywhere on the filesystem. This can enable attacker-control...

CVE-2018-11340

CVE-2018-11340 concerns an unrestricted file upload in ASUSTOR AS6202T ADM 3.1.0.RFQ3, specifically the importuser.cgi endpoint. The underlying issue is that the program accepts an uploaded file and saves it with a user-supplied filename, enabling an attacker to place attacker-controlled code on ...

PT-2018-10498

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description The issue allows attackers to upload supplied data to a specified filename due to an unrestricted file upload vulnerability in importuser.cgi. This can be used to place attacker-controlled cod...

PT-2018-10500

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue in the fileExplorer.cgi component allows attackers to specify arbitrary paths to system files, enabling them to create folders using the dest folder parameter...

PT-2018-10502

Name of the Vulnerable Software and Affected Versions ASUSTOR AS6202T ADM version 3.1.0.RFQ3 Description A path traversal issue exists, allowing attackers to specify any file on the system for download using the file1 parameter in the "download.cgi" endpoint. Recommendations For ASUSTOR AS6202T A...

CVE-2018-11342: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

CVE-2018-11344: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter...