Terramaster Operating System vulnerabilities | LiveThreat CVE Feed

Product

Terramaster Operating System

by Terra-master · last CVE Aug 20, 2023

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities28 In the news0 Timeline

Severity mix

Critical 7High 9Medium 12Low 0

Severity

All severities28 Critical7 High9 Medium12 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Terramaster Operating System to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-24990 RansomwareIn wildKEV	7.5	83%	Feb 7	TerraMaster OS Remote Command Execution Vulnerability Affected: before 4.2.31
CVE-2018-13418	8.8	5%	Nov 27	System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter Affected: 3.1.03
CVE-2018-13359	8.8	20%	Nov 27	Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter Affected: 3.1.03
CVE-2018-13358	8.8	25%	Nov 27	System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter Affected: 3.1.03
CVE-2018-13356	8.8	2%	Nov 27	Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions Affected: 3.1.03
CVE-2018-13353	8.8	6%	Nov 27	System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter Affected: 3.1.03
CVE-2018-13352	7.5	2%	Nov 27	Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory Affected: 3.1.03
CVE-2018-13332	7.5	2%	Nov 27	Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter Affected: 3.1.03
CVE-2018-13330	7.2	8%	Nov 27	System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter Affected: 3.1.03