533 matches found
PT-2018-11777
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster...
PT-2018-11776
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue is related to incorrect access control on the ajaxdata.php file, which allows attackers to elevate user permissions. Recommendations For TerraMaster TOS version 3.1.03, update to a version...
PT-2018-11759
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing shared folders via their descriptions, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS version 3.1.0...
PT-2018-11755
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames, due to cross-site scripting in the Control Panel. Recommendations For TerraMaster TOS...
PT-2018-11754
Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03 Description The issue allows attackers to execute system commands during group creation. This is achieved via the groupname parameter in the "ajaxdata.php" file. Recommendations For TerraMaster TOS version 3.1.03...
CVE-2018-13334: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...
CVE-2018-13337: Session Fixation
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript...
CVE-2018-13358: Improper Neutralization of Special Elements used in an OS Command
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter...
CVE-2018-13359: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...
CVE-2018-13361: Improper Input Validation
User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...
CVE-2018-13331: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...
CVE-2018-13352: Exposure of Sensitive Information to an Unauthorized Actor
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...
CVE-2018-13354: Improper Neutralization of Special Elements used in an OS Command
System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...
CVE-2018-13355: Incorrect Permission Assignment for Critical Resource
Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...
CVE-2018-13333: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames...
CVE-2018-13335: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions...
CVE-2018-13338: Improper Neutralization of Special Elements used in an OS Command
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...
CVE-2018-13351: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form...
CVE-2018-13356: Incorrect Authorization
Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions...
CVE-2018-13350: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter...