Terra-master Tos
14 CVEs affecting Terra-master Tos. Latest disclosed: 2022-04-25. Critical: 5, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45840 | Critical | 9.8 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/… |
CVE-2021-45837 | Critical | 9.8 | 2022-04-25 | It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /to… |
CVE-2020-15568 | Critical | 9.8 | 2021-01-30 | TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in i… |
CVE-2020-28188 | Critical | 9.8 | 2020-12-24 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php… |
CVE-2020-28187 | Critical | 9.8 | 2020-12-24 | Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the file… |
CVE-2021-45836 | High | 8.8 | 2022-04-25 | An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted… |
CVE-2021-45841 | High | 8.1 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passw… |
CVE-2020-29189 | High | 8.1 | 2020-12-24 | Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full acces… |
CVE-2021-45842 | High | 7.5 | 2022-04-25 | It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other infor… |
CVE-2020-28186 | High | 7.3 | 2020-12-24 | Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover. |
CVE-2021-45839 | Medium | 6.5 | 2022-04-25 | It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other infor… |
CVE-2020-28190 | Medium | 5.9 | 2020-12-24 | TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able… |
CVE-2020-28184 | Medium | 5.4 | 2020-12-24 | Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod para… |
CVE-2020-28185 | Medium | 5.3 | 2020-12-24 | User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username… |