Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.
Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.
System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.
Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter.
Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie.
Published 2018-11-26 · Modified
6.1EPSS 0.007
Demo
ThreatFusionAI™ Product Walkthrough
The fastest way to see what ThreatFusionAI does is to run a search. Paste any hash, IP, domain or CVE and you'll get the full report, the connected indicators and the actor attribution in one pass.
What you'll see
• Verdicts from multiple antivirus engines
• The connected IOC graph you can click through
• Ranked threat actors based on ATT&CK overlap
Next step
Start with a free search, no card needed. Check the plans if you need more volume.
ThreatFusionAI AssistantAI help & guidance
AI assistant — can make mistakes. Verify important results.