CVE Feed

    Dashboard / CVE / CVE-2018-15699

    CVE-2018-15699

    ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by inserting Javascript into the configuration files Version field.

    Published:Aug 27, 2018
    Last Modified:Nov 21, 2024
    EPS:Aug 27, 2018
    EPSS Score:0.0024
    CVSS Score:6.1

    Affected Products

    Vendor
    Asustor
    Product
    Data Master

    Exploits

    https://www.tenable.com/security/research/tra-2018-22https://www.tenable.com/security/research/tra-2018-22

    Related CVEs

    CVE-2026-6644 (CVSS 9.4) — A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an ad…
    CVE-2026-6643 (CVSS 8.6) — A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the …
    CVE-2026-3179 (CVSS 9.2) — The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing direc…
    CVE-2026-3100 (CVSS 8.3) — The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to …
    CVE-2026-24936 (CVSS 9.5) — When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validatio…
    CVE-2026-24935 (CVSS 6.3) — A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling ser…
    CVE-2026-24934 (CVSS 6.3) — The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying …
    CVE-2026-24933 (CVSS 8.9) — The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the s…
    CVE-2026-24932 (CVSS 8.9) — The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certifica…
    CVE-2025-13053 (CVSS 7) — When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verif…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High