CVE-2017-8248

A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation...

CVE-2017-8248

CVE-2017-8248 affects Apple iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation. The Telephony component’s downlink NAS message processing has a buffer overflow vulnerability, enabling a remote attacker in a privileged network position to execute arbitrary code. Apple...

CVE-2017-10234

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite subcomponent: NAS device addition. The supported version that is affected is 4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris Cluster executes to...

CVE-2017-10234

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite subcomponent: NAS device addition. The supported version that is affected is 4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris Cluster executes to...

QNAP Transcode Server Command Execution

This module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This module was tested successfully on a QNAP TS-431 with firmware version...

Western Digital MyCloud multi_uploadify File Upload Vulnerability

This module exploits a file upload vulnerability found in Western Digital's MyCloud NAS web administration HTTP service. The /web/jquery/uploader/multiuploadify.php PHP script provides multipart upload functionality that is accessible without authentication and can be used to place a file anywher...

[SECURITY] Fedora 26 Update: freeradius-3.0.15-1.fc26

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

Oracle Solaris Cluster Local Vulnerability (CNVD-2017-18119)

Oracle Sun Solaris is a computer operating system developed by Sun Microsystems. It is a derivative of the UNIX operating system. Oracle Solaris Cluster 4 has a security vulnerability in the implementation of the NAS device addition component that allows attackers to exploit vulnerabilities to...

New Linux Malware Exploits SambaCry Flaw to Silently Backdoor NAS Devices

Remember SambaCry? Almost two months ago, we reported about a 7-year-old critical remote code execution vulnerability in Samba networking software, allowing a hacker to remotely take full control of a vulnerable Linux and Unix machines. We dubbed the vulnerability as SambaCry, because of its...

Open Source Full Featured Network Operating System: OpenSwitch

Open Source Full Featured Network Operating System OpenSwitch provides a fully-featured L2/L3 control plane stack, traditional and programmatic, declarative control plane. The 24×7 nature of global digital economy and the explosion of data have changed how we think about data center networking...

The vulnerability of the Android operating system’s NAS component, which allows a hacker to trigger a service failure

The vulnerability of the Android operating system’s NAS component arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failure remotely...

[SECURITY] Fedora 25 Update: freeradius-3.0.14-1.fc25

The FreeRADIUS Server Project is a high performance and highly configurable GPL'd free RADIUS server. The server is similar in some respects to Livingston's 2.0 server. While FreeRADIUS started as a variant of the Cistron RADIUS server, they don't share a lot in common any more. It now has many...

Design/Logic Flaw

Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens...

CVE-2014-8687

Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens...

CVE-2014-8687

CVE-2014-8687 affects Seagate Business NAS devices with firmware older than 2015.00322. The vulnerability allows remote code execution with root privileges by exploiting a static encryption key used to create session tokens, enabling unauthenticated command execution via the CodeIgniter session c...

CVE-2014-8687

Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens...

CVE-2014-9923

In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist...

CVE-2014-9923

In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist...

CVE-2014-9923

CVE-2014-9923 is described in the provided records as a buffer copy without checking the input size, located in NAS for CAF Android releases using the Linux kernel. The vulnerability path is not fully detailed beyond this memory-unsafe copy, and exploitation details are not provided in the suppli...

TerraMaster NAS TOS <= 3.0.30 Unauthenticated RCE as Root

Recently I bought a TerraMaster F2-420 NAS from Amazon in order to store my private code, backups and this kind of stuff. As soon as it arrived I started to play with its web interface and eventually I wanted to see how it was implemented, moreover I was curious to see if I could find any remotel...