terra-master vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

TerraMaster NAS up to and including 4.2.30 allows remote WAN malicious users to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because pop...

Terra-master Terramaster Operating System

1 Metasploit module

7.5

CVSSv3

TerraMaster NAS 4.2.29 and previous versions allows remote malicious users to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.

Terra-master Terramaster Operating System

1 Metasploit module5 Github repositories

9.8

CVSSv3

Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated malicious users to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtabl...

Terra-master Tos

5.4

CVSSv3

Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.

Terra-master Tos

5.9

CVSSv3

TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.

Terra-master Tos

5.3

CVSSv3

User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated malicious users to identify valid users within the system via the username parameter to wizard/initialise.php.

Terra-master Tos

7.3

CVSSv3

Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated malicious users to abuse the forget password functionality and achieve account takeover.

Terra-master Tos

9.8

CVSSv3

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated malicious users to inject OS commands via /include/makecvs.php in Event parameter.

Terra-master Tos

1 Github repository

9.8

CVSSv3

TerraMaster TOS prior to 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the...

Terra-master Tos

2 Github repositories

8.1

CVSSv3

Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated malicious users to bypass read-only restriction and obtain full access to any folder within the NAS

Terra-master Tos

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook