CVE-2021-38306

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

Command injection

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

The CVE-2021-38306 entry concerns LG N1T1*** Network Attached Storage. Affected component: the en/ajp/plugins/access.ssh/checkInstall.php endpoint (destServer parameter). Root cause: OS command injection leading to unauthenticated remote code execution. Impact: attacker could gain root access on ...

PT-2021-22027 · Lg · Lg N1T1 Network Attached Storage

Name of the Vulnerable Software and Affected Versions: LG N1T1 Network Attached Storage affected versions not specified Description: The issue allows an unauthenticated attacker to gain root access via OS command injection in the destServer parameter of the...

QSAN Storage Manager 安全漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A directory traversal vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. An attacker could use this vulnerability to list arbitrary directories and further access...

QSAN Storage Manager 操作系统命令注入漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. QSAN Storage Manager suffers from an operating system command injection vulnerability that can be exploited by remote attackers to execute arbitrary commands...

Western Digital Users Face Another RCE

Bad news comes in threes, most particularly for Western Digital customers. As if things weren’t bad enough for the untold number of Western Digital customers whose data blinked out of existence last month, there’s another zero-day waiting for whoever can’t or won’t upgrade its My Cloud storage...

Zero-Day Used to Wipe My Book Live Devices

Western Digital will start providing free data-recovery services in July for people whose data was wiped off their network-attached storage NAS devices last week, the company said in an update on Tuesday. The company is also planning to offer a trade-in program to get customers onto the cloud –...

My Book Live Users Wake Up to Wiped Devices

If you haven’t already, stop reading and go yank your My Book Live storage device offline, lest you join the ranks of those who woke up on Thursday to find that years of data had been wiped clean on devices around the world. Western Digital’s My Book storage device is designed for consumers and...

QNAP Systems NAS 安全漏洞

Qnap Systems QNAP Systems Helpdesk is a helpdesk application from China Wizlink Qnap Systems. An access control error vulnerability exists in QNAP NAS, which can be exploited by remote attackers to compromise the security of the software...

VulnCheck KEV: CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted...

Terramaster TerraMaster FS-210 安全漏洞

The Terramaster TerraMaster FS-210 is a NAS Network Attached Storage device from Tumi Electronic Technology Terramaster of Shenzhen, China. A security vulnerability exists in the TerraMaster F2-210 devices that originates from allowing access to the device over the Internet on TCP port 8181...

CVE-2020-29490

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service Storage Processor Panic by sending specially...

CVE-2019-16959

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...

Tangro Business Workflow Security Vulnerability

Tangro Business Workflow is a software from the German company Tangro that allows you to visualize the internal control and approval processes of SAP document content. A security vulnerability exists in tangro Business Workflow before 1.18.1, which can be exploited to manipulate documents attache...

Western Digital My Cloud OS Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, which stems from a NAS management authentication bypass vulnerability that could allow an unauthenticated user to...

Unauthorized Access Vulnerability in the Website Building System of Beijing Jinfang Times Technology Co.

Beijing Jinfang Times Technology Co., Ltd. is a company that provides website construction services for enterprises, institutions and government agencies. An unauthorized access vulnerability exists in the website building system of Beijing Jinfang Times Technology Co. An attacker can exploit the...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the QNAP Systems TS-870 using firmware version 4.3.4.0486. An attacker could exploit the vulnerability to execute arbitrary JavaScript code...