QNAP QTS and QuTS hero operating system command injection vulnerability (CNVD-2025-27830)

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

CVE-2024-44114

SAP NetWeaver AS ABAP/ABAP Platform (CVE-2024-44114) is affected where users with high privileges can run a program that discloses data over the network, yielding minimal confidentiality impact. Affected component is the NetWeaver ABAP server; root cause is a missing access-control check that per...

Siemens Automation License Manager 输入验证错误漏洞

Siemens Automation License Manager is a license manager for Siemens products from Siemens, Germany. A denial of service vulnerability exists in Siemens Automation License Manager, which arises from an affected application failing to properly validate certain fields in incoming network packets on...

TOTOLINK AC1200 安全漏洞

TOTOLINK AC1200 is a dual-band Wi-Fi router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in the TOTOLINK AC1200 T84.1.5cu.861B20230220 version, which originates from the password parameter in the setWiFiRepeaterCfg method of the /cgi-bin/cstecgi.cgi page that fai...

CVE-2024-38640

A cross-site scripting XSS vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 2024/06/21 an...

CVE-2024-32763

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-21897

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722...

CVE-2023-50366

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-32763

CVE-2024-32763 affects QNAP QTS and QuTS hero. A buffer copy without input size checking can let an authenticated user execute code over the network. Affected products include QTS and QuTS hero, with fixes released in QTS 5.1.8.2823 build 20240712 and later, and QuTS hero h5.1.8.2823 build 202407...

CVE-2024-32762

CVE-2024-32762 affects QuLog Center. A cross-site scripting (XSS) vulnerability could allow network-based code injection via a user’s browser when interacting with the affected web interface. Affected versions include QuLog Center 1.7.0.827 and 1.8.0.872 and later; however, fixed releases are 1.7...

CVE-2024-21904 QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-51368 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to launch a denial-of-service DoS attack via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722...

CVE-2023-51366

CVE-2023-51366 concerns a path traversal vulnerability in QNAP’s QTS and QuTS hero OSes. The issue allows unauthorized access to read contents of files over the network on affected builds. Public material in the connected docs confirms the vulnerability impacts QTS and QuTS hero, with the underly...

PT-2024-21661 · Unknown · Notes Station 3

Name of the Vulnerable Software and Affected Versions: Notes Station 3 versions prior to 3.9.6 Description: A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network...

QNAP QTS和QuTS hero 操作系统命令注入漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

QNAP Systems QTS和QNAP Systems QuTS hero 代码问题漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems.QNAP Systems QTS is an operating system used by entry to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A code issue vulnerability exists in QNAP Systems QTS version 5.1.6.272...

CVE-2024-44997 net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkwed: fix use-after-free panic in mtkwedsetuptcblockcb When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cbpriv was fre...

SUSE CVE-2024-42284

In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipcudpaddr2str on error tipcudpaddr2str should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipcmediaaddrprintf. Fix this by returni...

CVE-2023-50315 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714...

CVE-2024-41731 Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the application. On successful exploitation, the attacker can cause a low impact on the Integrity of the application...