Filtered by vendor Asustor
Subscriptions
Total
52 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-11688 | 1 Asustor | 1 Exfat Driver | 2024-11-21 | 7.4 High |
| An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asustornasapi.asustor.com. In other words, there is Missing SSL Certificate Validation. | ||||
| CVE-2018-15699 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field. | ||||
| CVE-2018-15698 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to loginimage.cgi. | ||||
| CVE-2018-15697 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /home/admin/.ash_history. | ||||
| CVE-2018-15696 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. | ||||
| CVE-2018-15695 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi. | ||||
| CVE-2018-15694 | 1 Asustor | 1 Data Master | 2024-11-21 | N/A |
| ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled. | ||||
| CVE-2018-12319 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title. | ||||
| CVE-2018-12318 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. | ||||
| CVE-2018-12317 | 1 Asustor | 2 As-602t, Data Master | 2024-11-21 | N/A |
| OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. | ||||
| CVE-2018-12316 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. | ||||
| CVE-2018-12315 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. | ||||
| CVE-2018-12314 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters. | ||||
| CVE-2018-12313 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter. | ||||
| CVE-2018-12312 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. | ||||
| CVE-2018-12311 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename. | ||||
| CVE-2018-12310 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature. | ||||
| CVE-2018-12309 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345. | ||||
| CVE-2018-12308 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter. | ||||
| CVE-2018-12307 | 1 Asustor | 2 As602t, Data Master | 2024-11-21 | N/A |
| OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. | ||||