Seagate
17 CVEs across 26 Seagate products. Browse Seagate vulnerabilities, severities, and proof-of-concept exploits.
Seagate products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9267 | | 2025-09-26 | In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current workin… | |
CVE-2025-9043 | | 2025-08-14 | The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as… | |
CVE-2020-6627 | Critical | 9.8 | 2022-12-06 | The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in ci… |
CVE-2021-43429 | High | 7.5 | 2022-04-07 | A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a failture to release locks pool->lock. |
CVE-2018-18471 | Critical | 9.8 | 2019-06-19 | /api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chaine… |
CVE-2018-12304 | Medium | 6.1 | 2019-05-13 | Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields… |
CVE-2018-12303 | Medium | 5.4 | 2019-05-13 | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names. |
CVE-2018-12302 | Medium | 6.1 | 2019-05-13 | Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripti… |
CVE-2018-12301 | High | 7.5 | 2019-05-13 | Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or loc… |
CVE-2018-12300 | Medium | 6.1 | 2019-05-13 | Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL pa… |
CVE-2018-12299 | Medium | 5.4 | 2019-05-13 | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names. |
CVE-2018-12298 | High | 7.5 | 2019-05-13 | Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path. |
CVE-2018-12297 | Medium | 6.1 | 2019-05-13 | Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names. |
CVE-2018-12296 | High | 7.5 | 2019-05-13 | Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NA… |
CVE-2018-12295 | Critical | 9.8 | 2019-05-13 | SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter. |
CVE-2017-18263 | High | 7.5 | 2018-04-28 | Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url. |
CVE-2014-3206 | Critical | 9.8 | 2018-02-23 | Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name paramet… |
CVE-2014-3205 | Critical | 9.8 | 2018-02-23 | backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user. |
CVE-2018-5347 | Critical | 9.8 | 2018-01-12 | Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs… |
CVE-2015-7269 | Medium | 4.2 | 2017-11-27 | Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximate attackers to bypa… |
CVE-2015-7268 | Medium | 4.2 | 2017-11-27 | Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in Opal mode on Lenovo… |
CVE-2015-7267 | Medium | 4.2 | 2017-11-27 | Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opal or eDrive mode on… |
CVE-2013-6924 | Critical | 9.8 | 2017-10-11 | Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter… |
CVE-2014-8687 | Critical | 9.8 | 2017-06-08 | Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a stati… |
CVE-2015-2876 | High | 8.8 | 2015-12-31 | Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devic… |
CVE-2015-2875 | High | 7.5 | 2015-12-31 | Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL device… |
CVE-2015-2874 | Critical | 9.8 | 2015-12-31 | Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a d… |
CVE-2013-6922 | | 2014-01-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to h… | |
CVE-2013-6923 | | 2014-01-09 | Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331 allow remote attackers to inject arbit… | |
CVE-2012-2568 | | 2012-05-25 | d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password… |