QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37609)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37607)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

Western Digital MyCloud multi_uploadify File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HEAD', :uri = '/web/', :pattern = /Apache/ include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initializeinfo=...

Synology StorageManager 5.2 - Remote Root Command Execution Exploit

Exploit for cgi platform in category web applications ''' SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution Full report: https://blogs.securiteam.com/index.php/archives/3540 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory describes...

Synology StorageManager 5.2 - Root Remote Command Execution

''' SSD Advisory – Synology StorageManager smart.cgi Remote Command Execution Full report: https://blogs.securiteam.com/index.php/archives/3540 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory describes a remote command execution vulnerability found in...

QNAP Video Station Command Injection Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems that provides file storage, management, backup, multimedia applications and security monitoring. The system provides file storage, management, backup, multimedia applications and security monitoring, etc. Video Station is one of the video...

Design/Logic Flaw

Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php...

CVE-2013-6924

Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php...

CVE-2013-6924

Affected product: Seagate BlackArmor NAS sg2000-2000.1331. Vulnerability details: The firmware exposes an HTTP parameter in backupmgt/getAlias.php where a user-supplied ip value is used in shell commands (via grep/exec) without proper sanitization, allowing manipulation of the command line. This ...

CVE-2013-6924

Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php...

CVE-2017-13069

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 for QTS 4.2.x, 5.0.7 for QTS 4.3.x, and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS...

Command injection

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 for QTS 4.2.x, 5.0.7 for QTS 4.3.x, and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS...

CVE-2017-13069

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 for QTS 4.2.x, 5.0.7 for QTS 4.3.x, and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS...

Netgear Fixes 50 Vulnerabilities in Routers, Switches, NAS Devices

Netgear recently issued 50 patches for its routers, switches, NAS devices, and wireless access points to resolve vulnerabilities ranging from remote code execution bugs to authentication bypass flaws. Twenty of the patches address “high” vulnerability issues with the remaining 30 scored as “mediu...

Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution

Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remot...

Design/Logic Flaw

In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application...

CVE-2017-10700

In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application...

CVE-2017-10700

In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application...

CVE-2017-10700

CVE-2017-10700 affects QNAP NAS QTS medialibrary component version 4.3.3.0229. Multiple feeds (NVD, SUSE, CNVD, OpenVAS, Tenable) describe an unauthenticated, remote command-injection style vulnerability that allows an attacker to execute arbitrary system commands as the root user of the NAS appl...