U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): terramaster
  • Search Type: Search All
  • CPE Name Search: false
There are 48 matching records.
Displaying matches 41 through 48.
Vuln ID Summary CVSS Severity
CVE-2018-13333

Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames.

Published: November 27, 2018; 4:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2018-13332

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter.

Published: November 27, 2018; 4:29:00 PM -0500 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2018-13331

Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames.

Published: November 27, 2018; 4:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2018-13330

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter.

Published: November 27, 2018; 4:29:00 PM -0500 		V3.0: 7.2 HIGH
 V2.0: 9.0 HIGH
CVE-2018-13337

Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript.

Published: November 27, 2018; 3:29:00 PM -0500 		V3.0: 5.4 MEDIUM
 V2.0: 5.8 MEDIUM
CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter.

Published: November 27, 2018; 3:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2018-13329

Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter.

Published: November 27, 2018; 3:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2017-9328

Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root.

Published: September 15, 2017; 4:29:00 PM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 10.0 HIGH