R00T

**Name of the Vulnerable Software and Affected Versions** TerraMaster TOS versions 4.2.06 and earlier **Description** The issue allows remote unauthenticated attackers to identify valid users within the system. This is achieved via the `username` parameter to the "wizard/initialise.php" endpoint. **Recommendations** For TerraMaster TOS versions 4.2.06 and earlier, as a temporary workaround, consider restricting access to the "wizard/initialise.php" endpoint until a patch is available. Avoid using the `username` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TerraMaster TOS versions <= 4.2.06 Description: The issue is related to the "Event" parameter in the /include/makecvs.php file of the TerraMaster TOS operating system, which fails to neutralize special elements used in operating system commands. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability allows remote unauthenticated attackers to inject OS commands via the "Event" parameter in the /include/makecvs.php file. Recommendations: For TerraMaster TOS versions <= 4.2.06, update to a version later than 4.2.06 to resolve the issue. As a temporary workaround, consider restricting access to the /include/makecvs.php file and the `Event` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TerraMaster TOS versions 4.2.06 and earlier **Description** The issue allows remote authenticated attackers to bypass read-only restrictions, obtaining full access to any folder within the NAS. This is due to an Incorrect Access Control vulnerability. **Recommendations** For TerraMaster TOS versions 4.2.06 and earlier, update to a version later than 4.2.06 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TerraMaster TOS versions prior to 4.2.07 **Description** The issue allows remote unauthenticated attackers to abuse the forget password functionality, which can lead to account takeover. **Recommendations** For versions prior to 4.2.07, update to version 4.2.07 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Belkin F5D7230-4 Wireless G Router (affected versions not specified) **Description** The issue allows remote attackers to cause a denial of service, resulting in degraded networking and logging, via a flood of TCP SYN packets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MySpace Resource Script (MSRS) version 1.21 **Description** The issue allows remote attackers to execute arbitrary PHP code via a URL in the `rootBase` parameter in the ` theme/breadcrumb.php` file. **Recommendations** For MySpace Resource Script (MSRS) version 1.21, avoid using the `rootBase` parameter in the affected ` theme/breadcrumb.php` file until the issue is resolved. Restrict access to the ` theme/breadcrumb.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProfileCMS version 1.0 **Description** The issue allows remote attackers to upload and execute arbitrary PHP code. This is achieved through unspecified vectors involving the creation of a profile in the profiles script. **Recommendations** For ProfileCMS version 1.0, consider restricting or disabling the profiles script to prevent the upload and execution of arbitrary PHP code until a fix is available.

**Name of the Vulnerable Software and Affected Versions** WebChat version 0.78 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `rid` parameter in the "login.php" file. **Recommendations** For WebChat version 0.78, consider restricting access to the `login.php` file until a patch is available, and avoid using the `rid` parameter in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** webSPELL version 4.01.02 **Description** A SQL injection issue exists, allowing remote attackers to execute arbitrary SQL commands. This is achieved via the `picID` parameter in the "gallery.php" file. **Recommendations** For webSPELL version 4.01.02, consider restricting access to the `gallery.php` file or the `picID` parameter to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** vbPortal versions 3.0.2 through 3.6.0 Beta 1 **Description** The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the `bbvbplang` cookie when `magic quotes gpc` is disabled. This can be demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php. **Recommendations** For vbPortal versions 3.0.2 through 3.6.0 Beta 1, consider enabling `magic quotes gpc` to prevent directory traversal attacks. As a temporary workaround, restrict access to the `index.php` file and avoid using the `bbvbplang` cookie until a patch is available.