CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...

CVE-2018-13358

TerraMaster TOS 3.1.03 contains a command-injection flaw in ajaxdata.php via the checkName parameter, enabling remote execution of arbitrary commands and potential full system compromise as described in CVE-2018-13358. The vulnerability is corroborated by multiple advisories and CNVD/NVD records ...

CVE-2018-13334

TerraMaster TOS

CVE-2018-13355

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13360

Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter...

CVE-2018-13354

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...

CVE-2018-13331

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...

CVE-2018-13359

Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...

CVE-2018-13356

Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions...

CVE-2018-13332

CVE-2018-13332 concerns TerraMaster TOS. The connected documents confirm a directory traversal vulnerability in the explorer application of TerraMaster TOS version 3.1.03, which can be exploited to upload files to arbitrary locations via the URL parameter. The CVSS data provided indicates a high...

CVE-2018-13330

TerraMaster TOS 3.1.03 is affected by a system command injection in ajaxdata.php during group creation via the groupname parameter. The vulnerability allows an attacker to execute system commands on the device. Connected advisories (CNVD-2019-00661, NVD CVE-2018-13330, PRION-CVE-2018-13330, OpenV...

CVE-2018-13351

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...

CVE-2018-13338

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...

CVE-2018-13329

CVE-2018-13329 concerns TerraMaster TOS (version 3.1.03) where the endpoint ajaxdata.php is vulnerable to cross-site scripting (XSS) via the lines URL parameter. The described impact is that remote attackers can cause JavaScript execution in the context of a user session. The connected documents ...

CVE-2018-13335

CVE-2018-13335 affects TerraMaster TOS 3.1.03: Cross-site scripting in the Control Panel enables crafted folder descriptions to inject JavaScript when viewing shared folders. The information in the NVD entry and related advisories confirms the vulnerable component (Control Panel) and the nature o...

CVE-2018-13331

CVE-2018-13331 affects TerraMaster TOS (Control Panel) with version 3.1.03. The vulnerability is a cross-site scripting flaw that lets an attacker cause JavaScript execution by placing script code in usernames when viewing user pages. This is described in multiple sources referencing the TerraMas...

CVE-2018-13353

TerraMaster TOS 3.1.03 contains a command injection vulnerability in ajaxdata.php via the checkport parameter. The issue allows an attacker to execute arbitrary commands, as indicated by CVE-2018-13353 with high severity (CVSS v3.0 base 8.8). The connected documents confirm the affected endpoint ...

CVE-2018-13357

CVE-2018-13357 is an XSS in TerraMaster TOS 3.1.03. The vulnerability lies in the Control Panel where JavaScript can be executed when viewing Shared Folders, via the names of Shared Folders. Affected product/component: TerraMaster TOS Control Panel / Shared Folders naming. Impact: attacker can in...

CVE-2018-13350

CVE-2018-13350 —TerraMaster TOS 3.1.03 is affected by an SQL injection in the logtable.php file, exploitable via the Event parameter. This vulnerability allows execution of SQL queries and is described in multiple sources, including the NVD entry. The connected documents provide the vulnerable co...

CVE-2018-13349

CVE-2018-13349 is described as a cross-site scripting (XSS) vulnerability in the TerraMaster TOS web application taskbar for version 3.1.03. The issue allows an attacker to execute JavaScript via the user’s username. The connected documents corroborate XSS in TerraMaster TOS 3.1.03, but no explic...