CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11944 – iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-11944
06 Dec 2024 — iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tarfile.extractall method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. • https://www.truenas.com/docs/core/13.0/gettingstarted/corereleasenotes/#130-u63 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 3.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11946 – iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability
https://notcve.org/view.php?id=CVE-2024-11946
06 Dec 2024 — iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the use of an insecure protocol to deliver updates. • https://www.truenas.com/docs/core/13.0/gettingstarted/corereleasenotes/#130-u63 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 1CVE-2020-11650
https://notcve.org/view.php?id=CVE-2020-11650
08 Apr 2020 — An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent. Se detectó un problema en iXsystems FreeNAS versiones 11.2 y versiones 11.3 anteriores a 11.3-U1. Permite una denegación de servicio. • https://github.com/weinull/CVE-2020-11650 • CWE-307: Improper Restriction of Excessive Authentication Attempts •