533 matches found
CVE-2020-15568
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...
Code injection
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...
CVE-2020-15568
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...
CVE-2020-15568
TerraMaster TOS before 4.1.29 contains a dynamic class method invocation flaw in include/exportUser.php due to invalid parameter checking. An attacker can trigger a call to exec with OS commands (e.g., via the opt parameter), enabling remote code execution as root. Public guidance notes remediati...
CVE-2020-15568: Improper Control of Dynamically-Managed Code Resources
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...
Terramaster TOS 操作系统命令注入漏洞
TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A dynamic class method call vulnerability exists in include/exportUser.php in TerraMaster TOS versions prior to 4.1.29. The vulnerability stems from invalid parameter checking. An attacker can...
CVE-2020-15568
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter. Recen...
Linux Devices Under Attack by New FreakOut Malware
Researchers are warning a novel malware variant is targeting Linux devices, in order to add endpoints to a botnet to then be utilized in distributed-denial-of-service DDoS attacks and cryptomining. The malware variant, called FreakOut, has a variety of capabilities. Those include port scanning,...
FreakOut! Ongoing Botnet Attack Exploiting Recent Linux Vulnerabilities
An ongoing malware campaign has been found exploiting recently disclosed vulnerabilities in network-attached storage NAS devices running on Linux systems to co-opt the machines into an IRC botnet for launching distributed denial-of-service DDoS attacks and mining Monero cryptocurrency. The attack...
VulnCheck KEV: CVE-2020-28188
Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...
TerraMaster TOS Command Injection (CVE-2020-28188)
A command injection vulnerability exists in TerraMaster TOS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
VulnCheck KEV: CVE-2020-35665
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation...
Terramaster TOS < 4.2.07 Multiple Vulnerabilities - Active Check
Terramaster TOS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
TerraMaster TOS Cross-Site Scripting Vulnerability (CNVD-2020-75161)
TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A cross-site scripting vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the mod...
CVE-2020-29189
Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...
CVE-2020-28187
Multiple directory traversal vulnerabilities in TerraMaster TOS = 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the 1 filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to...
CVE-2020-28185
User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...
CVE-2020-28186
Email Injection in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover...