CVE-2018-11510

Summary (CVE-2018-11510) : ASUSTOR ADM NAS (3.1.0.RFQ3 and related builds) is vulnerable to an unauthenticated remote command injection in portal/apis/aggrecate_js.cgi via the script parameter. This leads to a remote code execution with high impact (CVSS v3.0: CRITICAL, 9.8; NETWORK, LOW UX, Priv...

CVE-2023-2509

CVE-2023-2509 is an XSS vulnerability affecting ASUSTOR ADM products (ADM 4.0.6.REG2, 4.1.0 and below; ADM 4.2.1.RGE2 and below) as well as LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below. The root cause is a cross-site scripting flaw that could allow an attacker to inject mal...

CVE-2022-37398

ASUSTOR Data Master (ADM) contains a stack-based buffer overflow in WebDAV when handling data size validation, affecting ADM versions 3.5.9.RUE3 and below, 4.0.5.RVI1 and below, and 4.1.0.RJD1 and below. The vulnerability could allow remote authenticated users to execute arbitrary code. Remediati...

CVE-2023-30770

CVE-2023-30770 affects ASUSTOR Data Master (ADM). The vulnerability is a stack-based buffer overflow caused by a lack of data size validation in ADM, allowing arbitrary code execution. Affected ADM versions include 4.0.6.REG2, 4.1.0 and below, and 4.2.0.RE71 and below. The OpenVAS/PRION/CNNVD/CVE...

CVE-2023-2909

CVE-2023-2909 describes a directory traversal vulnerability in the EZ Sync service of ASUSTOR ADM. The root cause is inadequate validation of user input, allowing an attacker to navigate outside the intended directory and delete files. Affected products/versions: ADM 4.0.6.REG2, 4.1.0 and earlier...