CVE-2015-5664

CVE-2015-5664 is a cross-site scripting (XSS) vulnerability in QNAP QTS File Station prior to 4.2.0. Multiple connected sources (JVN/JVNDB, CNVD, OpenVAS, Tenable/NASL) confirm that remote attackers can inject arbitrary script/HTML via unspecified vectors, potentially affecting web browser sessio...

CVE-2015-5664: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2016-3691

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.2.0 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 4.2.0, update to version 4.2.0 or later to resolve th...

QNAP QTS vulnerable to cross-site scripting

Overview QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Keigo YAMAZAKI of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

JVN#42930233: QNAP QTS vulnerable to cross-site scripting

QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Update to the latest version of firmware according to the information provided by the...

QNAP QTS Cross-Site Scripting Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A cross-site scripting vulnerability exists in QNAP QTS versions prior to 4.2.0. A remote attacker can exploit this vulnerability to...

QNAP Signage Station Server Detection

Binary data signagestationdetect.nbin...

QNAP Signage Station Arbitrary File Upload Vulnerability

The version of QNAP Signage Station running on the remote host is affected by an arbitrary file upload vulnerability in the contentTemplateDownload.php script. A remote attacker can exploit this, via an HTTP request, to upload arbitrary files. C Tenable Network Security, Inc. include"compat.inc";...

CVE-2015-7261

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

CVE-2015-7262

QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot...

CVE-2015-6036

QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request...

Unrestricted file upload

Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL...

Hardcoded credentials

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

Code injection

QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by registering an executable file, and then waiting for this file to be run in a privileged context after a reboot...

Authentication flaw

QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request...

CVE-2015-6022

Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL...

CVE-2015-6022

Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL...

CVE-2015-7261

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

CVE-2015-6022

QCV: CVE-2015-6022 describes an unrestricted file upload in QNAP Signage Station prior to version 2.0.1. An authenticated user can upload a dangerous file (e.g., a PHP script) and access it via a predictable URL to execute code with the server’s privileges. Impact is remote code execution with hi...

CVE-2015-7261

The FTP service in QNAP iArtist Lite (prior to version 1.4.54), distributed with QNAP Signage Station (prior to version 2.0.1), contains hardcoded credentials . This vulnerability allows remote attackers to obtain unauthorized access via a session on TCP port 21 . Additionally, the CNVD-2016-0138...