TerraMaster F4-210 / F2-210 Remote Code Execution Exploit

Terramaster F4-210 and F2-210 chained exploit that performs session crafting to achieve escalated privileges that then allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.x are affected. /bin/env python """ Product: Terramaster F4-210, Terramaster F2-210 Version: TOS...

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as we...

Tengfox TOS Behavioral Management System suffers from SQL Injection Vulnerability

Shenzhen Tengxu IOT Technology Co., Ltd. is an Internet technology company integrating R&D, design, manufacture, sales and service of commercial wireless network products. Tengfox TOS Behavior Management System has a SQL injection vulnerability, which can be exploited by attackers to obtain...

Weak password vulnerability in TOPSEC TOS WEB ADMINISTRATOR of Beijing Tianrongxin Technology Co.

Beijing Tianrongxin Technology Co., Ltd. is a leading provider of network security, big data and cloud services in China. A weak password vulnerability exists in TOPSEC TOS WEB ADMINISTRATOR of Beijing Tianrongxin Technology Co. Ltd, which can be exploited by attackers to obtain sensitive...

Weak Password Vulnerability in Tengfox TOS Behavior Management System

Shenzhen Tengxu IOT Technology Co., Ltd. was founded in August 2013, is a collection of commercial wireless network product research and development design, manufacturing, sales and service as one of the Internet technology companies. A weak password vulnerability exists in the Tengfox TOS behavi...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

TerraMaster TOS Command Injection (CVE-2020-15568)

A command injection vulnerability exists in TerraMaster TOS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Terramaster TOS <= 4.1.24 RCE Vulnerability - Active Check

Terramaster TOS is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

TerraMaster TOS Dynamic Class Method Invocation Vulnerability

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A dynamic class method call vulnerability exists in include/exportUser.php in TerraMaster TOS versions prior to 4.1.29. The vulnerability stems from invalid parameter checking. An attacker can...

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

Code injection

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter...

CVE-2020-15568

TerraMaster TOS before 4.1.29 contains a dynamic class method invocation flaw in include/exportUser.php due to invalid parameter checking. An attacker can trigger a call to exec with OS commands (e.g., via the opt parameter), enabling remote code execution as root. Public guidance notes remediati...

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter. Recen...

Design/Logic Flaw

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...

Design/Logic Flaw

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and...

CVE-2020-13133

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and...

CVE-2020-13134

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges for storing the XSS payload itself, and can exploit be triggered by admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...

Linux Devices Under Attack by New FreakOut Malware

Researchers are warning a novel malware variant is targeting Linux devices, in order to add endpoints to a botnet to then be utilized in distributed-denial-of-service DDoS attacks and cryptomining. The malware variant, called FreakOut, has a variety of capabilities. Those include port scanning,...