Cross site scripting

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5664

CVE-2015-5664 is a cross-site scripting (XSS) vulnerability in QNAP QTS File Station prior to 4.2.0. Multiple connected sources (JVN/JVNDB, CNVD, OpenVAS, Tenable/NASL) confirm that remote attackers can inject arbitrary script/HTML via unspecified vectors, potentially affecting web browser sessio...

CVE-2015-5664

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

QNAP QTS vulnerable to cross-site scripting

Overview QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Keigo YAMAZAKI of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

JVN#42930233: QNAP QTS vulnerable to cross-site scripting

QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Update to the latest version of firmware according to the information provided by the...

QNAP QTS Cross-Site Scripting Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A cross-site scripting vulnerability exists in QNAP QTS versions prior to 4.2.0. A remote attacker can exploit this vulnerability to...

QNAP Signage Station Server Detection

Binary data signagestationdetect.nbin...

QNAP Signage Station Arbitrary File Upload Vulnerability

The version of QNAP Signage Station running on the remote host is affected by an arbitrary file upload vulnerability in the contentTemplateDownload.php script. A remote attacker can exploit this, via an HTTP request, to upload arbitrary files. C Tenable Network Security, Inc. include"compat.inc";...

CVE-2015-7262

QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot...

CVE-2015-7261

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

CVE-2015-6036

QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request...

Authentication flaw

QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request...

Code injection

QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot...

Hardcoded credentials

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

Unrestricted file upload

Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL...

CVE-2015-6022

Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL...

CVE-2015-7261

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

CVE-2015-6022

QCV: CVE-2015-6022 describes an unrestricted file upload in QNAP Signage Station prior to version 2.0.1. An authenticated user can upload a dangerous file (e.g., a PHP script) and access it via a predictable URL to execute code with the server’s privileges. Impact is remote code execution with hi...

CVE-2015-7262

CVE-2015-7262 affects QNAP iArtist Lite (before 1.4.54) as distributed with Signage Station (before 2.0.1). A privileged execution flaw lets remote authenticated users register an executable that is run in a privileged context after a reboot, effectively gaining SYSTEM-level access. Root cause li...

CVE-2015-6036

CVE-2015-6036 affects QNAP Signage Station prior to version 2.0.1. An unauthenticated attacker can bypass authentication by sending a spoofed HTTP request, enabling remote upload of files to the server. The vulnerability is documented across multiple sources (NVD description aligns with the bypas...