PT-2018-8419

Name of the Vulnerable Software and Affected Versions QNAP NAS application Media Streaming add-on versions 421.1.0.2, 430.1.2.0, and earlier Description The issue concerns the lack of CSRF protections in the Media Streaming add-on, which could potentially allow for unauthorized actions...

PT-2018-8413

Name of the Vulnerable Software and Affected Versions QNAP NAS application Media Streaming add-on versions 421.1.0.2, 430.1.2.0, and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML into the Media Streaming add-on. The injected co...

CVE-2017-7634: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page...

PT-2018-8417

Name of the Vulnerable Software and Affected Versions QNAP NAS application Media Streaming add-on versions 421.1.0.2, 430.1.2.0, and earlier Description The issue is related to improper authentication of requests in the Media Streaming add-on. This could allow for unauthorized changes to Media...

CVE-2017-7640: Improper Neutralization of Special Elements used in an OS Command

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges...

CVE-2017-7641: Cross-Site Request Forgery (CSRF)

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections...

CVE-2017-7638: Improper Authentication

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS...

Information disclosure

QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device...

CVE-2017-7633

QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device...

CVE-2017-7633

QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device...

CVE-2017-7633

QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device...

CVE-2017-7633

The CVE-2017-7633 entry concerns QNAP Qfinder Pro (version 6.1.0.0317 and earlier). The connected sources describe an information-disclosure vulnerability in Qfinder Pro that could allow an attacker to obtain sensitive information stored on NAS devices and potentially leverage that to further com...

PT-2018-8412

Name of the Vulnerable Software and Affected Versions QNAP Qfinder Pro versions 6.1.0.0317 and earlier Description The issue may expose sensitive information contained in NAS devices, potentially allowing attackers to further compromise the device. Recommendations For QNAP Qfinder Pro versions...

CVE-2017-7633: Exposure of Sensitive Information to an Unauthorized Actor

QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device...

QNAP QTS Multiple RCE Vulnerabilities

QNAP QTS is prone to multiple remote code execution RCE vulnerabilities. This VT was deprecated since it is a duplicate of QNAP QTS 4.2.6 build 20171208, 4.3.3.x 4.3.3.0396 build 20171205, 4.3.4.x 4.3.4.0411 build 20171208 Multiple Vulnerabilities OID: 1.3.6.1.4.1.25623.1.0.107274...

Pre-auth Remote Code Execution exploit for QNAP QTS

!/usr/bin/env python -- coding: iso-8859-15 -- Pre-auth Remote Code Execution exploit for QNAP QTS 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 2017111 Just a quick dirty RCE PoC to make your QNAP sing "XMAS" in morse. Author: Andrea Palazzo @cogitoergor00t E-mail:...

CVE-2017-17033

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

Buffer overflow

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17027

A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

Buffer overflow

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...