RSS   Podatności dla 'TOS'   RSS

2021-01-30
 
CVE-2020-15568

CWE-78
 
 
TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

 
2020-12-24
 
CVE-2020-29189

CWE-863
 
 
Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS

 
 
CVE-2020-28190

NVD-CWE-noinfo
 
 
TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.

 
 
CVE-2020-28188

CWE-78
 
 
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.

 
 
CVE-2020-28187

CWE-22
 
 
Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php.

 
 
CVE-2020-28186

CWE-640
 
 
Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.

 
 
CVE-2020-28185

NVD-CWE-noinfo
 
 
User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.

 
 
CVE-2020-28184

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.

 
2017-09-15
 
CVE-2017-9328

CWE-78
 
 
Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root.

 

 >>> Vendor: Terra-master 2 Produkty
TOS
Terramaster operating system

Copyright 2024, cxsecurity.com

 

Back to Top