Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-13307 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13308 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13309 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13310 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13311 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13312 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13313 State: PUBLISHED Published: 2020-02-24T18:16:17 Last Updated: 2024-08-05T09:00:34.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 - https://www.ise.io/casestu
- https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 - https://www.ise.io/casestudies/sohopelessly-broken-2-0/
CVE ID: CVE-2018-13314 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13315 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13316 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13317 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
CVE ID: CVE-2018-13318 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13319 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13320 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13321 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13322 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:35.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13323 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13324 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:00:34.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/buffalo-terastation-ts5600d1206-nas-cve-disclosure-ab5d159f036d
CVE ID: CVE-2018-13325 State: PUBLISHED Published: 2018-07-05T18:00:00Z Last Updated: 2024-09-17T01:31:02.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/safecomet/EtherTokens/blob/master/GROWCHAIN%20%28GROW%29/GROWCHAIN%20%28GROW%29.md
CVE ID: CVE-2018-13326 State: PUBLISHED Published: 2018-07-05T00:00:00 Last Updated: 2024-08-05T09:00:34.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transfer and transferFrom functions of a smart contract implementation for Bittelux (BTX), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/safecomet/EtherTokens/blob/master/Bittelux%20%28BTX%29/Bittelux%20%28BTX%29.md - https://github.com/soohoio/VeriSmartBench/wiki/CVE-False-Reported-Case
CVE ID: CVE-2018-13327 State: PUBLISHED Published: 2018-07-05T00:00:00 Last Updated: 2024-08-05T09:00:35.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transfer and transferFrom functions of a smart contract implementation for ChuCunLingAIGO (CCLAG), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/safecomet/EtherTokens/blob/master/ChuCunLingAIGO%20%28CCLAG%29/ChuCunLingAIGO%20%28CCLAG%29.md - https://github.com/soohoio/VeriSmartBench/wiki/CVE-False-Reported-Case
CVE ID: CVE-2018-13328 State: PUBLISHED Published: 2018-07-05T18:00:00Z Last Updated: 2024-09-17T02:56:53.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The transfer, transferFrom, and mint functions of a smart contract implementation for PFGc, an Ethereum token, have an integer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/safecomet/EtherTokens/blob/master/PFGc%20%28PFGc%29/PFGc%20%28PFGc%29.md
CVE ID: CVE-2018-13329 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13330 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13331 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13332 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13333 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13334 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13335 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13336 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13337 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13338 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13339 State: PUBLISHED Published: 2018-07-05T22:00:00 Last Updated: 2024-08-05T09:00:35.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gleez/cms/issues/796 - https://github.com/TylerGarlick/angular-redactor/issues/77
CVE ID: CVE-2018-13340 State: PUBLISHED Published: 2018-07-05T22:00:00 Last Updated: 2024-08-05T09:00:35.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gleez CMS 1.2.0 has CSRF, as demonstrated by a /page/add request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gleez/cms/issues/795
CVE ID: CVE-2018-13341 State: PUBLISHED Published: 2018-08-10T19:00:00Z Last Updated: 2024-09-16T18:44:09.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execute hidden API calls and escape the CTP console sandbox environment with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105051 - https://ics-cert.us-cert.gov/advis
tes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105051 - https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
CVE ID: CVE-2018-13342 State: PUBLISHED Published: 2018-10-24T22:00:00 Last Updated: 2024-08-05T09:00:35.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server API in the Anda app relies on hardcoded credentials. Additional Analyst Notes: - CVE Program Container: References: - https://gustavosilva.me/blog/2018/10/23/How-I-hacked-Anda-the-public-transportation-app-of-Porto-CVE-2018-13342.html
CVE ID: CVE-2018-13346 State: PUBLISHED Published: 2018-07-06T00:00:00 Last Updated: 2024-08-05T09:00:35.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 - https://www.mercurial-scm.org/repo/hg/rev/faa924469635 - https://access.redhat.com/errata/RHSA-2019:2276 - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2018-13347 State: PUBLISHED Published: 2018-07-06T00:00:00 Last Updated: 2024-08-05T09:00:34.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 - https://www.mercurial-scm.org/repo/hg/rev/1acfc35d478c - https://access.redhat.com/errata/RHSA-2019:2276 - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.ht
78c - https://access.redhat.com/errata/RHSA-2019:2276 - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2018-13348 State: PUBLISHED Published: 2018-07-06T00:00:00 Last Updated: 2024-08-05T09:00:35.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001. Additional Analyst Notes: - CVE Program Container: References: - https://www.mercurial-scm.org/repo/hg/rev/90a274965de7 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 - https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
CVE ID: CVE-2018-13349 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13350 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13351 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13352 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13353 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13354 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13355 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:34.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13356 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a