Vulnerabilities

TI-2023-02727 CVE-2023-2909 · GHSA-28mp-g2wm-23p3

A Directory traversal vulnerability was found on EZ Sync service of ADM

MEDIUM 44

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00673 Published 2023-05-31 No fix listed CWE-22

TI-2023-02353 CVE-2023-2509 · GHSA-69cg-q6pw-v79j

Cross-site scripting in ASUSTOR ADM

LOW 33

A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00338 Published 2023-05-17 No fix listed CWE-79

TI-2023-14583 CVE-2023-30770 · GHSA-gh84-757g-2vhr

A stack-based buffer overflow vulnerability was found in the ADM

MEDIUM 43

A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00614 Published 2023-04-17 No fix listed CWE-787

TI-2022-17472 CVE-2022-37398 · GHSA-p489-wgjc-48gr

A stack-based buffer overflow vulnerability was found on ADM

LOW 39

A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00725 Published 2022-08-05 No fix listed CWE-121

TI-2018-08230 CVE-2018-11510 · GHSA-r3m4-x4g8-pm2w

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code…

HIGH 71

The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.43659 Published 2018-06-28 No fix listed CWE-78