Media Streaming add-on request authentication vulnerability

The Media Streaming add-on is an add-on for each station in QTS that allows you to stream media simultaneously to different devices in different locations using AirPlay, DLNA, Chromecast, and HDMI-connected devices. A request authentication vulnerability exists in the QNAP NAS application Media...

QNAP NAS application Media Streaming add-on arbitrary OS command execution vulnerability

QNAP NAS application Media Streaming add-on is a video streaming loading application for QNAP NAS devices from QNAP Systems. A security vulnerability exists in the QNAP NAS application Media Streaming add-on version 421.1.0.2 and earlier and version 430.1.2.0 and earlier. A remote attacker can...

Media Streaming add-on Cross-Site Request Forgery Vulnerability

QNAP NAS application Media Streaming add-on is a video streaming loading application for QNAP NAS devices from QNAP Systems. A security vulnerability exists in QNAP NAS application Media Streaming add-on 421.1.0.2 and earlier and 430.1.2.0 and earlier, which stems from the program not implementin...

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

Cross site scripting

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

Cross site request forgery (csrf)

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

Design/Logic Flaw

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges...

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7634

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

CVE-2017-7641

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

CVE-2017-7640

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges...

Design/Logic Flaw

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7641

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

CVE-2017-7634

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

CVE-2017-7640

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges...

CVE-2017-7634

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

CVE-2017-7641

The CVE-2017-7641 entry documents a CSRF vulnerability in the QNAP NAS Media Streaming add-on. Affected versions include 421.1.0.2, 430.1.2.0, and earlier. Root cause: the add-on does not implement CSRF protections, which could allow an attacker to coerce an authenticated user to perform maliciou...

CVE-2017-7640

CVE-2017-7640 affects the QNAP NAS Media Streaming add-on for the firmware versions 421.1.0.2, 430.1.2.0, and earlier. The vulnerability allows remote attackers to execute arbitrary operating system commands with root privileges on the affected NAS devices. The connected documents confirm the aff...

CVE-2017-7634

CVE-2017-7634 is a cross-site scripting (XSS) vulnerability in the QNAP NAS application Media Streaming add-on (versions 421.1.0.2, 430.1.2.0, and earlier). The issue allows remote attackers to inject arbitrary web script or HTML when a user clicks a crafted link; the injected code is triggered o...