CVE-2018-0728

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

CVE-2018-0729

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions...

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions...

Command injection

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions...

Command injection

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions...

Design/Logic Flaw

An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak...

Improper access control

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

Cross site scripting

A stored cross-site scripting XSS vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version...

CVE-2019-7201

An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak...

CVE-2019-7201

The CVE-2019-7201 entry concerns an unquoted service path vulnerability in the QNAP NetBak Replicator component QVssService. The Red Hat/NVD records confirm that an authorized but non-privileged local user could abuse the unquoted path to execute arbitrary code with elevated system privileges. Th...

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions...

CVE-2018-0729

CVE-2018-0729 affects QNAP Music Station and describes a remote command execution (RCE) via a command injection vulnerability. Multiple connected sources identify Music Station as the affected component and state that an attacker could execute commands on the affected device. The remediation is t...

CVE-2018-0729

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions...

CVE-2018-0728

CVE-2018-0728 concerns an improper access control vulnerability in QNAP Helpdesk within QTS. The available documents indicate that the issue allows an attacker to access system logs. The fixes are to update QTS and Helpdesk to the latest versions. The exact root cause, affected version(s), and ex...

CVE-2018-0728

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions...

QNAP QTS and Photo Station Local File Inclusion

This module exploits a local file inclusion in QNAP QTS and Photo Station that allows an unauthenticated attacker to download files from the QNAP filesystem. Because the HTTP server runs as root, it is possible to access sensitive files, such as SSH private keys and password hashes. This module h...

PT-2019-6309 · Qnap · Qts

Name of the Vulnerable Software and Affected Versions: QNAP QTS affected versions not specified Description: This issue is related to improper input validation, allowing remote attackers to inject arbitrary code into the system. There is no information provided about the estimated number of...

Multiple QNAP Products NAS-201911-25 Multiple Security Vulnerabilities

Description Multiple QNAP products are prone to multiple security vulnerabilities. An attacker can exploit these issues to gain unauthorized access to the affected device, inject and execute arbitrary code and read or write arbitrary files on the device. Technologies Affected Qnap Photo Station...

Multiple QNAP Products NAS-201911-20 Multiple Security Vulnerabilities

Description Multiple QNAP products are prone to multiple security vulnerabilities. An attacker may leverage these issues to execute arbitrary commands or gain unauthorized access to the affected device. Technologies Affected Qnap Helpdesk 1.0.06 Qnap Helpdesk 1.1.01 Qnap Helpdesk 1.2.0 Qnap...

QNAP NetBak Replicator 4.5.6.0607 Unquoted Service Path

Exploit Title: QNAP NetBak Replicator 4.5.6.0607 - 'QVssService' Unquoted Service Path Discovery Date: 2019-11-05 Exploit Author: Ivan Marmolejo Vendor Homepage: https://www.qnap.com/en/ Software Link: https://www.qnap.com/en/download Version: 4.5.6.0607 Vulnerability Type: Local Tested on: Windo...