Command injection

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

Information disclosure

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

Command injection

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

CVE-2017-5227

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

CVE-2017-6359

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

CVE-2017-6360

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

CVE-2017-6361

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

CVE-2017-5227

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

CVE-2017-6359

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

CVE-2017-6360

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

CVE-2017-6361

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

CVE-2017-5227

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

CVE-2017-5227

CVE-2017-5227 affects QNAP QTS prior to 4.2.4 Build 20170313. Local (non‑remote) users can read data stored in XOR format inside /etc/config/uLinux.conf to obtain sensitive Domain Administrator password information. The available connected documents consistently describe the same effect and targe...

CVE-2017-6360

CVE-2017-6360 affects QNAP QTS prior to 4.2.4 Build 20170313. The issue is described as a QTS command-injection vulnerability that allows an attacker to gain administrator/root privileges and to access sensitive information via unspecified vectors. Related references and connected documents consi...

CVE-2017-6359

CVE-2017-6359 affects QNAP QTS prior to 4.2.4 Build 20170313. The QTS web UI CGI binaries permit unauthenticated command injection, enabling an attacker to gain administrator/root privileges and execute arbitrary commands via unspecified vectors. Public references include Exploit-DB (exploit 4184...

CVE-2017-6361

CVE-2017-6361 affects QNAP QTS prior to 4.2.4 Build 20170313. The QTS web UI CGI binaries contain multiple command‑injection vulnerabilities (CWE-77) that allow an unauthenticated attacker to execute arbitrary commands on the device, potentially as root. Exploitation details indicate remote comma...

CVE-2017-6360

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

CVE-2017-6359

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

CVE-2017-6361

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

QNAP QTS Privilege Escalation / Information Disclosure

QNAP QTS Domain Privilege Escalation Vulnerability Name Sensitive Data Exposure in QNAP QTS Systems Affected QNAP QTS NAS all model and all versions 4.2.4 Severity High 7.9/10 Impact CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Vendor http://www.qnap.com/ Advisory...