CVE-2020-28187

TerraMaster TOS

CVE-2020-28186

Email Injection in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover...

CVE-2020-28186

TerraMaster TOS is affected up to version 4.2.06 by an Email Injection vulnerability that allows remote unauthenticated attackers to abuse the forget-password function and potentially take over accounts. The issue is described in CVE-2020-28186 (NVD) with CVSS: CVSSv3.1 base score 7.3 (High) and ...

CVE-2020-28184

TerraMaster TOS vulnerable to Cross-site scripting (XSS) in versions 4.2.06 and earlier. The flaw allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php. This is documented across multiple sources (NVD, CNVD, Red Hat, CNVD CNVD-2020-751...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-28185

User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...

CVE-2020-28185

CVE-2020-28185 affects TerraMaster TOS (older than or equal to 4.2.06). The vulnerability allows remote, unauthenticated attackers to enumerate valid usernames through the username parameter on wizard/initialise.php. This user enumeration could facilitate targeted credential or further intra-syst...

PT-2020-17106

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated attackers to bypass read-only restrictions, obtaining full access to any folder within the NAS. This is due to an Incorrect Access Control...

CVE-2020-28188

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...

PT-2020-5870 · Terramaster · Terramaster Tos

Name of the Vulnerable Software and Affected Versions: TerraMaster TOS versions = 4.2.06 Description: The issue is related to the "Event" parameter in the /include/makecvs.php file of the TerraMaster TOS operating system, which fails to neutralize special elements used in operating system command...

CVE-2020-28187: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in TerraMaster TOS = 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the 1 filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to...

CVE-2020-28188: Improper Neutralization of Special Elements used in an OS Command

Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...

CVE-2020-29189: Undefined Security Weakness

Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...

CVE-2020-28184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-28190: Undefined Security Weakness

TerraMaster TOS = 4.2.06 was found to check for updates of both system and applications via an insecure channel HTTP. Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates...

CVE-2020-28185: Undefined Security Weakness

User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php...

Terramaster TOS Operating System Command Injection Vulnerability

TerraMaster TOS is a Linux-based operating system for TerraMaster Cloud Storage NAS servers from TerraMaster. An OS command injection vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which originates from an OS command injection vulnerability found in the Event paramet...

TerraMaster TOS Remote Code Execution Vulnerability

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A remote code execution vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. An attacker can exploit this vulnerability to execute commands without authentication via shell...

Terramaster TOS 跨站脚本漏洞

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A cross-site scripting vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the mod...

Terramaster TOS Authorization Issues Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. An authorization issue vulnerability exists in TerraMaster TOS version 4.2.06 and prior versions, which originates from email...