terra-master tos vulnerabilities and exploits

(subscribe to this query)

5.4

CVSSv3

Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.

Terra-master Tos

8.1

CVSSv3

Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated malicious users to bypass read-only restriction and obtain full access to any folder within the NAS

Terra-master Tos

9.8

CVSSv3

Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated malicious users to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtabl...

Terra-master Tos

9.8

CVSSv3

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated malicious users to inject OS commands via /include/makecvs.php in Event parameter.

Terra-master Tos

1 Github repository

5.3

CVSSv3

User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated malicious users to identify valid users within the system via the username parameter to wizard/initialise.php.

Terra-master Tos

7.3

CVSSv3

Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated malicious users to abuse the forget password functionality and achieve account takeover.

Terra-master Tos

5.9

CVSSv3

TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.

Terra-master Tos

9.8

CVSSv3

TerraMaster TOS prior to 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the...

Terra-master Tos

2 Github repositories

8.8

CVSSv3

An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the request through /tos/index.php?app/hand_app.

Terra-master Tos 4.2.15-2107141517

9.8

CVSSv3

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to /tos/index.php?app/app_start_stop.

Terra-master Tos 4.2.15-2107141517

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook