CVE-2018-11510

The ASUSTOR ADM operating system (versions 3.1.0.RFQ3 and all previous builds) is vulnerable to an unauthenticated remote code execution (RCE) flaw. The root cause is improper neutralization of special elements used in an OS command (CWE-78), where an attacker can inject arbitrary commands via th...

CVE-2023-2509

CVE-2023-2509 is an XSS vulnerability affecting ASUSTOR ADM products (ADM 4.0.6.REG2, 4.1.0 and below; ADM 4.2.1.RGE2 and below) as well as LooksGood 2.0.0.R129 and below and SoundsGood 2.3.0.r1027 and below. The root cause is a cross-site scripting flaw that could allow an attacker to inject mal...

CVE-2022-37398

ASUSTOR Data Master (ADM) contains a stack-based buffer overflow in WebDAV when handling data size validation, affecting ADM versions 3.5.9.RUE3 and below, 4.0.5.RVI1 and below, and 4.1.0.RJD1 and below. The vulnerability could allow remote authenticated users to execute arbitrary code. Remediati...

CVE-2023-30770

CVE-2023-30770 affects ASUSTOR Data Master (ADM). The vulnerability is a stack-based buffer overflow caused by a lack of data size validation in ADM, allowing arbitrary code execution. Affected ADM versions include 4.0.6.REG2, 4.1.0 and below, and 4.2.0.RE71 and below. The OpenVAS/PRION/CNNVD/CVE...

CVE-2023-2909

CVE-2023-2909 describes a directory traversal vulnerability in the EZ Sync service of ASUSTOR ADM. The root cause is inadequate validation of user input, allowing an attacker to navigate outside the intended directory and delete files. Affected products/versions: ADM 4.0.6.REG2, 4.1.0 and earlier...