Asustor Data Master vulnerabilities
45 vulnerabilities
Known vulnerabilities in Asustor Data Master, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-15697asustordata_master+1
EPSS score0.91%
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /home/admin/.ash_history.CVE-2018-15696asustordata_master+1EPSS score0.73%
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi.CVE-2018-15698asustordata_master+1EPSS score1.11%
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to loginimage.cgi.CVE-2018-15699asustordata_master+1EPSS score0.65%
ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field.CVE-2018-15695asustordata_master+1EPSS score1.01%
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerability in wallpaper.cgi.CVE-2018-15694asustordata_master+1EPSS score1.51%
ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnerability. This could lead to code execution if the "Web Server" feature is enabled.CVE-2018-12311asustordata_masterEPSS score0.55%
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename.CVE-2018-12317asustordata_masterEPSS score3.44%
OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter.CVE-2018-12305asustordata_masterEPSS score0.69%
Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript.CVE-2018-12316asustordata_masterEPSS score3.44%
OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter.CVE-2018-12306asustordata_masterEPSS score1.74%
Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344.CVE-2018-12307asustordata_masterEPSS score3.44%
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter.CVE-2018-12308asustordata_masterEPSS score0.59%
Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter.CVE-2018-12315asustordata_masterEPSS score0.68%
Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password.CVE-2018-12312asustordata_masterEPSS score3.44%
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter.CVE-2018-12319asustordata_masterEPSS score1.18%
Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.CVE-2018-12309asustordata_masterEPSS score1.50%
Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter. NOTE: the "filename" POST parameter is covered by CVE-2018-11345.CVE-2018-12313asustordata_masterEPSS score4.35%
OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL parameter.CVE-2018-12310asustordata_masterEPSS score0.55%
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.CVE-2018-12318asustordata_masterEPSS score1.10%
Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext.