Login Request a demo
TO
Product
Terramaster Operating System
by Terra-master · last CVE Aug 20, 2023
On CISA KEVExploited in the wildRansomware-linked
28
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities28In the news0Timeline
Severity mix
Critical 7High 9Medium 12Low 0
Severity
All severities28Critical7High9Medium12Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Terramaster Operating System to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-24990
RansomwareIn wildKEV
7.5
83%
Feb 7
TerraMaster OS Remote Command Execution Vulnerability
Affected: before 4.2.31
CVE-2022-24989
9.8
32%
Aug 20
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the…
Affected: before 4.2.31
CVE-2020-35665
9.8
78%
Dec 23
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV…
Affected: through 4.2.06
CVE-2018-13354
9.8
23%
Nov 27
System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter
Affected: 3.1.03
CVE-2018-13350
9.8
17%
Nov 27
SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter
Affected: 3.1.03
CVE-2018-13338
9.8
10%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation
Affected: 3.1.03
CVE-2018-13336
9.8
9%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation
Affected: 3.1.03
CVE-2017-9328
9.8
7%
Sep 15
Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root
Affected: through 3.0.33
CVE-2018-13418
8.8
5%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter
Affected: 3.1.03
CVE-2018-13359
8.8
20%
Nov 27
Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter
Affected: 3.1.03
CVE-2018-13358
8.8
25%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter
Affected: 3.1.03
CVE-2018-13356
8.8
2%
Nov 27
Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions
Affected: 3.1.03
CVE-2018-13353
8.8
6%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter
Affected: 3.1.03
CVE-2018-13352
7.5
2%
Nov 27
Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory
Affected: 3.1.03
CVE-2018-13332
7.5
2%
Nov 27
Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter
Affected: 3.1.03
CVE-2018-13330
7.2
8%
Nov 27
System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter
Affected: 3.1.03
CVE-2018-13355
6.5
1%
Nov 27
Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization
Affected: 3.1.03
CVE-2018-13360
6.1
1%
Nov 27
Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter
Affected: 3.1.03
CVE-2018-13349
6.1
1%
Nov 27
Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username
Affected: 3.1.03
CVE-2018-13333
6.1
1%
Nov 27
Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames
Affected: 3.1.03
CVE-2018-13331
6.1
1%
Nov 27
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames
Affected: 3.1.03
CVE-2018-13334
6.1
1%
Nov 27
Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter
Affected: 3.1.03
CVE-2018-13329
6.1
1%
Nov 27
Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter
Affected: 3.1.03
CVE-2018-13357
5.4
1%
Nov 27
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names
Affected: 3.1.03
CVE-2018-13335
5.4
1%
Nov 27
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions
Affected: 3.1.03
CVE-2018-13337
5.4
1%
Nov 27
Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript
Affected: 3.1.03
CVE-2018-13361
5.3
17%
Nov 27
User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter
Affected: 3.1.03
CVE-2018-13351
4.8
1%
Nov 27
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form
Affected: 3.1.03
Showing 28