Terra-master
Terra-master Terramaster Operating System: vulnerabilidades y CVE
Terra-master Terramaster Operating System tiene 28 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 7 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE28
Últimos 12 meses0
Críticas7
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-24990 | Alta (7.5) | 83% | ⚠ Explotación activa | 7 feb 2023 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-24989 | Crítica (9.8) | 32% | — | 20 ago 2023 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell… |
| CVE-2022-24990 | Alta (7.5) | 83% | ⚠ Explotación activa | 7 feb 2023 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response. |
| CVE-2020-35665 | Crítica (9.8) | 78% | — | 23 dic 2020 | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. |
| CVE-2018-13418 | Alta (8.8) | 5.2% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter. |
| CVE-2018-13361 | Media (5.3) | 17% | — | 27 nov 2018 | User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter. |
| CVE-2018-13360 | Media (6.1) | 1.3% | — | 27 nov 2018 | Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter. |
| CVE-2018-13359 | Alta (8.8) | 20% | — | 27 nov 2018 | Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter. |
| CVE-2018-13358 | Alta (8.8) | 25% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter. |
| CVE-2018-13357 | Media (5.4) | 0.85% | — | 27 nov 2018 | Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names. |
| CVE-2018-13356 | Alta (8.8) | 2.0% | — | 27 nov 2018 | Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions. |
| CVE-2018-13355 | Media (6.5) | 1.1% | — | 27 nov 2018 | Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization. |
| CVE-2018-13354 | Crítica (9.8) | 23% | — | 27 nov 2018 | System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter. |
| CVE-2018-13353 | Alta (8.8) | 5.9% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter. |
| CVE-2018-13352 | Alta (7.5) | 1.9% | — | 27 nov 2018 | Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory. |
| CVE-2018-13351 | Media (4.8) | 0.86% | — | 27 nov 2018 | Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form. |
| CVE-2018-13350 | Crítica (9.8) | 17% | — | 27 nov 2018 | SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter. |
| CVE-2018-13349 | Media (6.1) | 1.1% | — | 27 nov 2018 | Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username. |
| CVE-2018-13338 | Crítica (9.8) | 10% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation. |
| CVE-2018-13336 | Crítica (9.8) | 9.1% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation. |
| CVE-2018-13335 | Media (5.4) | 0.85% | — | 27 nov 2018 | Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions. |
| CVE-2018-13333 | Media (6.1) | 1.1% | — | 27 nov 2018 | Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames. |
| CVE-2018-13332 | Alta (7.5) | 2.3% | — | 27 nov 2018 | Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter. |
| CVE-2018-13331 | Media (6.1) | 1.1% | — | 27 nov 2018 | Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames. |
| CVE-2018-13330 | Alta (7.2) | 8.1% | — | 27 nov 2018 | System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter. |
| CVE-2018-13337 | Media (5.4) | 1.2% | — | 27 nov 2018 | Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript. |
| CVE-2018-13334 | Media (6.1) | 1.1% | — | 27 nov 2018 | Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter. |
| CVE-2018-13329 | Media (6.1) | 1.1% | — | 27 nov 2018 | Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter. |
| CVE-2017-9328 | Crítica (9.8) | 7.4% | — | 15 sept 2017 | Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.