CVE-2024-54501

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Processing a maliciously crafted file may lead to a denial of service...

CVE-2024-54501

The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted file may lead to a denial of service...

CVE-2024-54501

CVE-2024-54501 affects Apple operating systems and is tied to processing a maliciously crafted file that may lead to denial of service. The published fix mentions iPadOS 18.2, iOS 18.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, macOS Sequoia 15.2, watchOS 11.2, visionOS 2.2, and tvOS 18.2. The d...

CVE-2024-54486

The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted font may result in the disclosure of process memory...

PT-2025-3038 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.2 watchOS versions prior to 11.2 tvOS versions prior to 18.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue is related to a buffer overflow in the IOMobileFrameBuffer component of...

Vulnerabilities fixed in QNAP operating systems

QNAP has fixed vulnerabilities in several versions of their operating systems, including QTS and QuTS hero. The vulnerabilities include improper authentication, certificate validation issues, incorrect URL encryption, CRLF injection and command injection. These vulnerabilities allowed attackers t...

CVE-2024-50393

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and...

CVE-2024-50403

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the...

CVE-2024-50403

CVE-2024-50403 affects QNAP QTS and QuTS hero where a use of externally-controlled format string could allow remote attackers with administrator access to obtain secret data or modify memory. Root cause: externally-controlled format string vulnerability. Affected versions have been fixed in QTS 5...

CVE-2024-50402 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the...

CVE-2024-48868

CVE-2024-48868 is a CRLF injection vulnerability reported to affect QNAP QTS and QuTS hero. The flaw permits remote modification of application data when exploited. Affected versions have been fixed: QTS 5.1.9.2954 build 20241120 and later; QTS 5.2.2.2950 build 20241114 and later; QuTS hero h5.1....

CVE-2024-48867 QTS, QuTS hero

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

CVE-2024-48867 QTS, QuTS hero

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

CVE-2024-48866 QTS, QuTS hero

An improper handling of URL encoding Hex Encoding vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state. We have already fixed the vulnerability in the following...

CVE-2024-48866 QTS, QuTS hero

An improper handling of URL encoding Hex Encoding vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state. We have already fixed the vulnerability in the following...

CVE-2024-48865

CVE-2024-48865 concerns an improper certificate validation vulnerability affecting QNAP QTS and QuTS hero. Multiple sources confirm impact across QTS 5.1.9.2954+ (build 20241120+), QTS 5.2.2.2950+ (build 20241114+), QuTS hero h5.1.9.2954+ (build 20241120+), and QuTS hero h5.2.2.2952+ (build 20241...

CVE-2024-50387 SMB Service

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service...

CVE-2024-50387

CVE-2024-50387 is a SQL-injection vulnerability in QNAP SMB Service affecting multiple QNAP operating system versions. The connected documents confirm the flaw allows remote attackers to inject malicious code, with root causes tied to improper handling of input that enables SQL query manipulation...

QNAP Systems QTS和QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems, Inc.QNAP Systems QTS is an entry-level operating system.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP Systems QTS and QuTS hero that stems from the...

CVE-2024-52548 Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass

An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111...