Vulnerabilities

TI-2018-08089 CVE-2018-11346 · GHSA-6cmq-gxq2-w376

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM…

LOW 23

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the sys…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01231 Published 2018-05-22 No fix listed CWE-425

TI-2018-08088 CVE-2018-11345 · GHSA-42fm-7h9g-phq7

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3…

MEDIUM 42

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filename.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0186 Published 2018-05-22 No fix listed CWE-434

TI-2018-08087 CVE-2018-11344 · GHSA-w3mp-p5pr-xccf

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows…

LOW 32

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via the file1 parameter.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01403 Published 2018-05-22 No fix listed CWE-22

TI-2018-08085 CVE-2018-11342 · GHSA-chg2-ppmp-2x98

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3…

LOW 22

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01093 Published 2018-05-22 No fix listed CWE-22

TI-2018-08084 CVE-2018-11341 · GHSA-xj6r-gmjj-ghvc

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers…

LOW 36

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02098 Published 2018-05-22 No fix listed CWE-22

TI-2018-08083 CVE-2018-11340 · GHSA-3r2h-p7c8-w9jw

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM…