CVE-2018-19951

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11...

CVE-2018-19952

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11...

CVE-2018-19951

CVE-2018-19951 is a Cross-Site Scripting (XSS) vulnerability in QNAP Music Station web interface. The root cause is insufficient input validation by the Music Station web application, enabling remote attackers to inject client-side code. Affected versions are QNAP Music Station prior to 5.1.13, p...

CVE-2018-19952

CVE-2018-19952 is a SQL injection vulnerability in QNAP Music Station that could allow remote attackers to obtain application information. Affected versions are Music Station prior to 5.1.13, prior to 5.2.9, and prior to 5.3.11. The root cause is an SQL injection flaw that enables data disclosure...

CVE-2018-19950

CVE-2018-19950 is a command injection vulnerability in QNAP Music Station that could allow a remote attacker to execute arbitrary commands over the network without authentication, affecting Music Station versions prior to 5.1.13, 5.2.9, and 5.3.11. Exploitation details are corroborated by multipl...

CVE-2020-3703

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central deviceThis CVE is equivalent to Link Layer Length Overfow issue CVE-2019-16336,CVE-2019-17519 and Silent Length Overflow issueCVE-2019-17518 mentioned in...

CVE-2020-3704

u'While processing invalid connection request PDU which is nonstandard interval or timeout is 0 from central device may lead peripheral system enter into dead lock state.This CVE is equivalent to InvalidConnectionRequestCVE-2019-19193 mentioned in sweyntooth paper' in Snapdragon Auto, Snapdragon...

CVE-2020-3684

u'QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2020-3693

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017,...

CVE-2020-11174

u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

CVE-2020-11169

u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2020-11162

u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

Design/Logic Flaw

u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables,...

CVE-2020-3703

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central deviceThis CVE is equivalent to Link Layer Length Overfow issue CVE-2019-16336,CVE-2019-17519 and Silent Length Overflow issueCVE-2019-17518 mentioned in...

CVE-2020-3694

CVE-2020-3694 affects Qualcomm Snapdragon components (Auto/Compute/Mobile/Voice & Music) with an out-of-range pointer issue caused by an incorrect buffer range check during the execution of qseecom. Affected devices/SoCs include Bitra, Nicobar, Saipan, SM6150, SM8150, SM8250, and SXR2130 under Sn...

CVE-2020-3693

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017,...

CVE-2020-3694

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in Bitra, Nicobar, Saipan, SM6150, SM8150, SM8250, SXR2130...

CVE-2020-11141

CVE-2020-11141 describes a buffer over-read in Bluetooth estack caused by a missing length check on the L2CAP configuration request from a peer. Affected are Qualcomm Snapdragon platforms (e.g., APQ8009, APQ8053, QCA6390, QCN7605, SM8250, and others across Snapdragon Auto/Compute/Connectivity/UIs...

PT-2020-8658 · Qnap Systems · Music Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11 Description: This issue is a command injection vulnerability that could...

PT-2020-8659 · Qnap Systems · Music Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11 Description: This issue is a cross-site scripting vulnerability that cou...