Terra-master Terramaster_operating_system
28 CVEs affecting Terra-master Terramaster_operating_system. Latest disclosed: 2023-08-20. Critical: 7, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24989 | Critical | 9.8 | 2023-08-20 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instanti… |
CVE-2020-35665 | Critical | 9.8 | 2020-12-23 | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs… |
CVE-2018-13354 | Critical | 9.8 | 2018-11-27 | System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter. |
CVE-2018-13350 | Critical | 9.8 | 2018-11-27 | SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter. |
CVE-2018-13338 | Critical | 9.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user… |
CVE-2018-13336 | Critical | 9.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user crea… |
CVE-2017-9328 | Critical | 9.8 | 2017-09-15 | Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root. |
CVE-2018-13418 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter. |
CVE-2018-13359 | High | 8.8 | 2018-11-27 | Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter. |
CVE-2018-13358 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter. |
CVE-2018-13356 | High | 8.8 | 2018-11-27 | Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions. |
CVE-2018-13353 | High | 8.8 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter. |
CVE-2022-24990 | High | 7.5 | 2023-02-07 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNa… |
CVE-2018-13352 | High | 7.5 | 2018-11-27 | Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory. |
CVE-2018-13332 | High | 7.5 | 2018-11-27 | Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL pa… |
CVE-2018-13330 | High | 7.2 | 2018-11-27 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname… |
CVE-2018-13355 | Medium | 6.5 | 2018-11-27 | Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization. |
CVE-2018-13360 | Medium | 6.1 | 2018-11-27 | Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter. |
CVE-2018-13349 | Medium | 6.1 | 2018-11-27 | Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username. |
CVE-2018-13333 | Medium | 6.1 | 2018-11-27 | Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript i… |