CVE-2018-13324

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

Command injection

System Command Injection in network.setauthsettings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters...

Design/Logic Flaw

Incorrect access control in getportalinfo in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request...

CVE-2018-13321

Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter...

CVE-2018-13324

Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header...

CVE-2018-13319

CVE-2018-13319 concerns Buffalo TS5600D1206 firmware, affected in version 3.61-0.10, where an incorrect access control in get_portal_info permits an unauthenticated POST request to disclose sensitive device information. This vulnerability represents an information disclosure risk due to insuffici...

CVE-2018-13320

System Command Injection in network.setauthsettings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters...

CVE-2018-13324

Buffalo TS5600D1206 NAS firmware (version 3.61-0.10) contains an authentication bypass in nasapi. The root cause is improper access control that allows an attacker to bypass login by sending a modified HTTP Host header. Public references in the connected documents corroborate this vulnerability a...

CVE-2018-13322

Directory traversal in listfolders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter...

CVE-2018-13319

Incorrect access control in getportalinfo in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request...

CVE-2018-13323

CVE-2018-13323 affects Buffalo TS5600D1206 (version 3.61-0.10). The vulnerability is a cross-site scripting flaw in the detail.html page that allows an attacker to run JavaScript via the username cookie , as documented in multiple sources. The NVD entry describes a standard XSS where the cookie v...

CVE-2018-13321

CVE-2018-13321 affects Buffalo TS5600D1206 NAS devices (nasapi) with version 3.61-0.10. Root cause: incorrect access controls that let an attacker invoke dangerous internal functions via the method parameter. Documented impact indicates high severity (CVSS3: 8.8; confidentiality, integrity, and a...

CVE-2018-13322

Buffalo TS5600D1206 (firmware 3.61-0.10) is affected by CVE-2018-13322 due to a directory traversal vulnerability in the list_folders function. The issue allows an attacker to list directory contents by supplying a crafted path parameter. CVSS information in the initial record indicates a network...

CVE-2018-13318

Buffalo TS5600D1206, version 3.61-0.10, contains a command‑injection in the User.create method allowing an attacker to execute system commands via the name parameter. Root cause: unsanitized input in user creation. Impact: remote command execution; severity reflects high impact on confidentiality...

CVE-2018-13318

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

CVE-2018-13323

Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie...

CVE-2018-13320

Buffalo TS5600D1206 (firmware version 3.70-0.10) contains a Command Injection vulnerability in the network.set_auth_settings function. The issue allows an attacker to trigger system commands via the adminUsername and adminPassword parameters, enabling potential remote command execution over a net...

Buffalo NAS Detection (HTTP)

HTTP based detection of Buffalo LinkStation / TeraStation Network Attached Storage devices. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Buffalo TeraStation Web detection

Binary data buffaloterastationdetect.nbin...

Buffalo AirStation Detection (HTTP)

HTTP based detection of Buffalo AirStation. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...