CVE-2022-27600

CVE-2022-27600 is an uncontrolled resource consumption vulnerability impacting several QNAP OS lines, notably QTS, QuTS hero, and QuTScloud. According to connected sources, remote attackers could cause a denial-of-service (DoS). Affected products/versions include QTS 5.0.1.2277 and later, QTS 4.5...

CVE-2023-23354 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in...

CVE-2023-23354

CVE-2023-23354 affects QNAP QuLog Center. The vulnerability is an XSS flaw in QuLog Center before specific fixed versions, allowing remote attackers with user access to bypass security or read data. Affected versions include prior to 1.3.1.645, prior to 1.4.1.691, and prior to 1.5.0.738. The fixe...

CVE-2023-23354 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in...

CVE-2023-23356 QuFirewall

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions:...

CVE-2023-23356

CVE-2023-23356 is a command-injection vulnerability in QNAP QuFirewall. The issue allows remote attackers who have gained administrator access to execute arbitrary commands via the QuFirewall module on affected QNAP OS versions. Affected/impacted component: QuFirewall (QNAP devices). Root cause d...

CVE-2023-23356 QuFirewall

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions:...

CVE-2023-23357 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the...

CVE-2023-23357

CVE-2023-23357 affects QNAP’s QuLog Center (various versions) with a cross-site scripting (XSS) flaw. The vulnerability arises in QuLog Center prior to fixed versions and could let an attacker with administrator access bypass security controls or read application data. Affected/fixed details per ...

CVE-2023-23357 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the...

QNAP Systems QuLog Center 跨站脚本漏洞

QNAP Systems QuLog Center is a report field at China Weilian Technology QNAP Systems that logs events reported by the system. A cross-site scripting vulnerability exists in QNAP Systems QuLog Center versions 1.5, 1.4, and 1.3 that originates from a vulnerability that could allow a remote attacker...

QNAP Systems QuLog Center 跨站脚本漏洞

QNAP Systems QuLog Center is a report field for China Weilian Technology QNAP Systems that records events reported by the system. A cross-site scripting vulnerability exists in QNAP Systems QuLog Center versions 1.5, 1.4, and 1.3 that originates from a vulnerability that could allow a remote...

QNAP QTS Multiple Vulnerabilities (QSA-24-49)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

QNAP QuTS hero Multiple Vulnerabilities (QSA-24-49)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

Vulnerabilities fixed in QNAP operating systems

QNAP has fixed vulnerabilities in several versions of their operating systems, including QTS and QuTS hero. The vulnerabilities include improper authentication, certificate validation issues, incorrect URL encryption, CRLF injection and command injection. These vulnerabilities allowed attackers t...

EUVD-2024-52034

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-53691

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-53691

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-50402

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the...

CVE-2024-50387

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service...