CVE-2017-13073

CVE-2017-13073 affects QNAP NAS Photo Station (versions 5.2.7, 5.4.3 and earlier). The vulnerability is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML. Connected sources corroborate the affected product/version range and the XSS nature, ...

Seagate Media Server Path Traversal

------------------------------------------------------------------------ Seagate Media Server path traversal vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2017 -----------------------------------------------------------------------...

Seagate Personal Cloud SRN21C Arbitrary File Move

------------------------------------------------------------------------ Seagate Personal Cloud allows moving of arbitrary files ------------------------------------------------------------------------ Yorick Koster, September 2017...

Critical Unpatched RCE Flaw Disclosed in LG Network Storage Devices

If you have installed a network-attached storage device manufactured by LG Electronics, you should take it down immediately, read this article carefully and then take appropriate action to protect your sensitive data. A security researcher has revealed complete technical details of an unpatched...

QNAP QTS cross-site scripting vulnerability (CNVD-2018-08349)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A cross-site scripting vulnerability exists in File Station in QNAP QTS 4.2.6 build 20171026 and earlier and QTS 4.3.3 build 20170727...

TwonkyMedia Server 7.0.11-8.5 Directory Traversal

--------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27 Exploit Author: Sven Fassbender Contact:...

TwonkyMedia Server 7.0.11-8.5 - Directory Traversal Exploit

Exploit for multiple platform in category web applications ''' --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27...

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit...

TwonkyMedia Server 7.0.11-8.5 - Directory Traversal

''' --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Directory Traversal Date: 2018-03-27 Exploit Author: Sven Fassbender Contact:...

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting

TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting --------------------------------------------------------------------- 1. About --------------------------------------------------------------------- Exploit Title: TwonkyMedia Server 7.0.11-8.5 Persistent XSS Date: 2018-03-27 Exploit...

Design/Logic Flaw

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges...

Cross site scripting

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

CVE-2017-7641

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

Cross site request forgery (csrf)

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7634

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7641

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

Design/Logic Flaw

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7634

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...