CVE-2018-13354

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...

CVE-2018-13330

TerraMaster TOS 3.1.03 is affected by a system command injection in ajaxdata.php during group creation via the groupname parameter. The vulnerability allows an attacker to execute system commands on the device. Connected advisories (CNVD-2019-00661, NVD CVE-2018-13330, PRION-CVE-2018-13330, OpenV...

CVE-2018-13355

Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization...

CVE-2018-13334

TerraMaster TOS

CVE-2018-13332

CVE-2018-13332 concerns TerraMaster TOS. The connected documents confirm a directory traversal vulnerability in the explorer application of TerraMaster TOS version 3.1.03, which can be exploited to upload files to arbitrary locations via the URL parameter. The CVSS data provided indicates a high...

CVE-2018-13338

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...

CVE-2018-13331

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames...

CVE-2018-13359

Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter...

CVE-2018-13349

CVE-2018-13349 is described as a cross-site scripting (XSS) vulnerability in the TerraMaster TOS web application taskbar for version 3.1.03. The issue allows an attacker to execute JavaScript via the user’s username. The connected documents corroborate XSS in TerraMaster TOS 3.1.03, but no explic...

CVE-2018-13352

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory...

CVE-2018-13360

TerraMaster TOS 3.1.03 Text Editor is vulnerable to cross-site scripting via the filename URL parameter, enabling an attacker to inject and execute JavaScript. This is documented in CVE-2018-13360 and corroborated by CNVD/NVD entries and related OpenVAS data, all indicating the issue centers on t...

CVE-2018-13335

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions...

CVE-2018-13330

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter...

CVE-2018-13357

CVE-2018-13357 is an XSS in TerraMaster TOS 3.1.03. The vulnerability lies in the Control Panel where JavaScript can be executed when viewing Shared Folders, via the names of Shared Folders. Affected product/component: TerraMaster TOS Control Panel / Shared Folders naming. Impact: attacker can in...

CVE-2018-13361

User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter...

CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

CVE-2018-13332

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter...

CVE-2018-13335

CVE-2018-13335 affects TerraMaster TOS 3.1.03: Cross-site scripting in the Control Panel enables crafted folder descriptions to inject JavaScript when viewing shared folders. The information in the NVD entry and related advisories confirms the vulnerable component (Control Panel) and the nature o...

CVE-2018-13331

CVE-2018-13331 affects TerraMaster TOS (Control Panel) with version 3.1.03. The vulnerability is a cross-site scripting flaw that lets an attacker cause JavaScript execution by placing script code in usernames when viewing user pages. This is described in multiple sources referencing the TerraMas...

CVE-2018-13354

TerraMaster TOS 3.1.03 is affected by a system command injection in logtable.php exposed via the Event parameter, enabling an attacker to execute arbitrary commands. Multiple sources (NVD, CNVD, OpenVAS, PRION, CVELIST) corroborate that the flaw is reachable remotely (network) with high/critical ...