Approved changes feed: RSS · Atom
cpe:2.3:o:terra-master:tos:*:*:*:*:*:*:*:*
part: o version: * update: *
| Vendor | Terra Master (d89fe82a-9386-553b-9a83-7412a03e5915) |
|---|---|
| Product | Tos (d5bb3ff4-b89c-586d-8050-149b9baaebb8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-34539 |
vulnerable | 2026-06-08 06:37:33.448811 |
Details available
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions.
Published: 2024-06-14T00:00:00.000Z
Updated: 2024-08-02T02:59:20.976Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-29189 |
vulnerable | 2026-06-08 05:24:58.016536 |
Details available
Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS
Published: 2020-12-24T14:36:59.000Z
Updated: 2026-07-09T00:12:02.348Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28190 |
vulnerable | 2026-06-08 05:23:53.838019 |
Details available
TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.
Published: 2020-12-24T14:34:32.000Z
Updated: 2024-08-04T16:33:57.797Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28188 |
vulnerable | 2026-06-08 05:23:53.837556 |
Details available
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.
Published: 2020-12-24T00:00:00.000Z
Updated: 2024-08-04T16:33:58.217Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28187 |
vulnerable | 2026-06-08 05:23:53.837250 |
Details available
Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1) filename parameter to /tos/index.php?editor/fileGet, Event parameter to /include/ajax/logtable.php, or opt parameter to /include/core/index.php.
Published: 2020-12-24T14:31:58.000Z
Updated: 2024-08-04T16:33:58.311Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28186 |
vulnerable | 2026-06-08 05:23:53.836648 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28185 |
vulnerable | 2026-06-08 05:23:53.836328 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28184 |
vulnerable | 2026-06-08 05:23:53.835916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-15568 |
vulnerable | 2026-06-08 05:19:26.115454 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.