CVE-2017-7635

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections...

CVE-2017-7635

The CVE-2017-7635 entry concerns QNAP NAS Proxy Server (versions up to 1.2.0) that does not utilize CSRF protections. This lack enables CSRF-style abuse against affected installations, potentially allowing unauthorized state-changing actions initiated by an authenticated user’s session. The provi...

PT-2018-8418

Name of the Vulnerable Software and Affected Versions QNAP NAS application Proxy Server versions prior to 1.2.1 Description The issue is related to improper authentication of requests. Successful exploitation can lead to unauthorized changes in the settings of the Proxy Server. Recommendations Fo...

PT-2018-8416

Name of the Vulnerable Software and Affected Versions QNAP NAS application Proxy Server versions prior to 1.2.1 Description The issue allows remote attackers to run arbitrary OS commands against the system with root privileges. Recommendations For versions prior to 1.2.1, update to version 1.2.1 ...

PT-2018-8415

Name of the Vulnerable Software and Affected Versions QNAP NAS application Proxy Server versions prior to 1.2.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 1.2.0, update to version 1.2.0 or late...

PT-2018-8414

Name of the Vulnerable Software and Affected Versions QNAP NAS application Proxy Server versions prior to 1.2.1 Description The issue is related to the lack of CSRF protections in the Proxy Server application. Recommendations For versions prior to 1.2.1, update to version 1.2.1 or later to resolv...

CVE-2017-7639: Improper Authentication

QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server...

CVE-2017-7637: Improper Neutralization of Special Elements used in an OS Command

QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges...

CVE-2017-7635: Cross-Site Request Forgery (CSRF)

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections...

FBI: Kindly Reboot Your Router Now, Please

The Federal Bureau of Investigation FBI is warning that a new malware threat has rapidly infected more than a half-million consumer devices. To help arrest the spread of the malware, the FBI and security firms are urging home Internet users to reboot routers and network-attached storage devices...

QNAP QTS Remote Command Injection (CVE-2013-0143)

Remote command injection vulnerabilities exist in QNAP QTS. A remote attacker can exploit these weaknesses to execute arbitrary commands in the affected devices via a crafted request...

VPNFilter Destructive Malware

NCCIC is aware of a sophisticated modular malware system known as VPNFilter. Devices known to be affected by VPNFilter include Linksys, MikroTik, NETGEAR, and TP-Link networking equipment, as well as QNAP network-attached storage NAS devices. Devices compromised by VPNFilter may be vulnerable to...

QNAP PhotoStation Cross Site Scripting

Exploit QNAP PhotoStation 5.x Cross-Site Scripting Date: 5/22/2018 Exploit Author: SaeedReza Zamanian Software Link: https://www.qnap.com/en/appcenter/conshow.php?op=showone&internalName=PhotoStation&version=5.7.0&down1name=TS-251&jumpwin=1&qts=4.3.4&seq=120 Vendor Home Page: https://www.qnap.com...

QNAP QTS XSS Vulnerability (nas-201804-27)

QNAP QTS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

QNAP NAS Photo Station XSS Vulnerability (nas-201804-23)

QNAP NAS Photo Station is prone to a cross-site scripting XSS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

QNAP Photo Station Detection (HTTP)

HTTP based detection of QNAP Photo Station. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2018-0711

Cross-site scripting XSS vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML...

Cross site scripting

Cross-site scripting XSS vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML...

CVE-2018-0711

Cross-site scripting XSS vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML...

CVE-2018-0711

Cross-site scripting XSS vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML...