CVE-2021-34355

CVE-2021-34355 is a cross-site scripting (XSS) vulnerability in QNAP Photo Station for NAS. The issue affects Photo Station prior to fixed releases and could allow remote code injection via the web interface. Fixed versions are Photo Station 5.4.10 and later, 5.7.13 and later, and 6.0.18 and late...

CVE-2021-34355 Stored XSS Vulnerability in Photo Station

A cross-site scripting XSS vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10...

QNAP NAS 跨站脚本漏洞

QNAP NAS is an accessible and fast storage solution from QNAP China. A cross-site scripting vulnerability exists in QNAP NAS, which can be exploited by remote attackers to inject malicious code. The following products and versions are affected: Photo Station versions prior to 5.4.10 August 19,...

How to Set Up a NAS to Securely Share Files

From file backups to movie streaming, network attached storage drives offer plenty of functions and features...

Vulnerabilities fixed in QNAP nas

QNAP has fixed vulnerabilities in nas systems. The vulnerabilities allow a malicious person to execute arbitrary code execute arbitrary code. QNAP has released updates to fix the vulnerability. More information can be found on the pages below: CVE-2021-28816 and CVE-2021-34343:...

CVE-2018-19957

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS...

Design/Logic Flaw

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS...

CVE-2018-19957 Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS...

CVE-2018-19957

CVE-2018-19957 concerns insufficient HTTP security headers in QNAP QTS, QuTS hero, and QuTScloud. The vulnerability affects QNAP NAS platforms running QTS, QuTS hero, and QuTScloud, enabling remote attackers to launch privacy/security attacks. The issue has been addressed by explicit fixes: QTS 4...

QNAP NAS 缓冲区错误漏洞

QNAP NAS is an accessible and fast storage solution from QNAP China. A security vulnerability exists in QNAP NAS, which allows a remote, unauthenticated attacker to trigger a stack-based buffer overflow and execute arbitrary code on the target system. The following products and versions are...

QNAP NAS 缓冲区错误漏洞

QNAP NAS is an accessible and fast storage solution from QNAP China. A security vulnerability exists in QNAP NAS that stems from a boundary error. A remote, unauthenticated attacker could send a specially crafted request to trigger a stack-based buffer overflow and execute arbitrary code on the...

QNAP Working on Patches for OpenSSL Flaws Affecting its NAS Devices

Network-attached storage NAS appliance maker QNAP said it's currently investigating two recently patched security flaws in OpenSSL to determine their potential impact, adding it will release security updates should its products turn out to be vulnerable. Tracked as CVE-2021-3711 CVSS score: 7.5 a...

QNAP Is Latest to Get Dinged by OpenSSL Bugs Fallout

On Monday, QNAP put out two security advisories about OpenSSL remote-code execution and denial-of-service DoS bugs, fixed last week, that affect its network-attached storage NAS devices. The vulnerabilities are tracked as CVE-2021-3711 – a high-severity buffer overflow related to SM2 decryption–...

A week in security (August 9 – August 15)

Last week on Malwarebytes Labs: Home routers are being hijacked using a vulnerability disclosed just 2 before Ransomware turncoat leaks Conti data, lifts the lid on the ransomware business Check your passwords! Synology NAS devices are under attack from StealthWorker PrintNightmare and RDP RCE...

VulnCheck KEV: CVE-2020-36195

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of...

Seagate BlackArmor NAS RCE Vulnerability (Jul 2021)

Seagate BlackArmor NAS is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...

Linux Variant of HelloKitty Ransomware Targets VMware ESXi Servers

For the first time, researchers have publicly spotted a Linux encryptor used by the HelloKitty ransomware gang: the outfit behind the February attack on videogame developer CD Projekt Red. On Wednesday, MalwareHunterTeam disclosed its discovery of numerous Linux ELF-64 versions of the HelloKitty...

Seagate BlackArmor NAS sg2000-2000.1331 Command Injection

Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Date: 15.07.2021 Discovered by: Jeroen - IT Nerdbox Exploit Author: Metin Yunus Kandemir Version: sg2000-2000.1331 Vendor Homepage: https://www.seagate.com/ Software Link:...

Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Exploit

Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Discovered by: Jeroen - IT Nerdbox Exploit Author: Metin Yunus Kandemir Version: sg2000-2000.1331 Vendor Homepage: https://www.seagate.com/ Software Link:...

Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection

Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Date: 15.07.2021 Discovered by: Jeroen - IT Nerdbox Exploit Author: Metin Yunus Kandemir Version: sg2000-2000.1331 Vendor Homepage: https://www.seagate.com/ Software Link:...