Filtered by vendor Asustor
Subscribe
Total
38 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-15697 | 1 Asustor | 1 Data Master | 2024-02-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /home/admin/.ash_history. | |||||
| CVE-2018-15695 | 1 Asustor | 1 Data Master | 2024-02-04 | 8.5 HIGH | 6.5 MEDIUM |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi. | |||||
| CVE-2018-12319 | 1 Asustor | 2 As602t, Data Master | 2024-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title. | |||||
| CVE-2018-12307 | 1 Asustor | 2 As602t, Data Master | 2024-02-04 | 9.0 HIGH | 8.8 HIGH |
| OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. | |||||
| CVE-2018-12315 | 1 Asustor | 2 As602t, Data Master | 2024-02-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. | |||||
| CVE-2018-12318 | 1 Asustor | 2 As602t, Data Master | 2024-02-04 | 4.0 MEDIUM | 8.8 HIGH |
| Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. | |||||
| CVE-2018-12317 | 1 Asustor | 2 As-602t, Data Master | 2024-02-04 | 9.0 HIGH | 8.8 HIGH |
| OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. | |||||
| CVE-2018-12314 | 1 Asustor | 2 As602t, Data Master | 2024-02-04 | 7.8 HIGH | 7.5 HIGH |
| Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters. | |||||
| CVE-2018-12305 | 1 Asustor | 1 Data Master | 2024-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript. | |||||
| CVE-2018-11509 | 1 Asustor | 1 Asustor Data Master | 2024-02-04 | 7.5 HIGH | 9.8 CRITICAL |
| ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell. | |||||
| CVE-2018-11344 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter. | |||||
| CVE-2018-11342 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 4.0 MEDIUM | 4.3 MEDIUM |
| A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter. | |||||
| CVE-2018-11345 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 6.5 MEDIUM | 8.8 HIGH |
| An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename. This can be used to place attacker controlled code on the file system that can then be executed. Further, the filename parameter is vulnerable to path traversal and allows the attacker to place the file anywhere on the system. | |||||
| CVE-2018-11346 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 4.0 MEDIUM | 4.3 MEDIUM |
| An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act parameter. | |||||
| CVE-2018-11341 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 6.5 MEDIUM | 7.2 HIGH |
| Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter. | |||||
| CVE-2018-11343 | 1 Asustor | 1 Soundsgood | 2024-02-04 | 3.5 LOW | 5.4 MEDIUM |
| A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter. | |||||
| CVE-2018-11340 | 1 Asustor | 2 As6202t, As6202t Firmware | 2024-02-04 | 9.0 HIGH | 7.2 HIGH |
| An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed. | |||||
| CVE-2018-11510 | 1 Asustor | 1 Adm | 2024-02-04 | 5.0 MEDIUM | 9.8 CRITICAL |
| The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter. | |||||