4525 matches found
JVN#55667175: QNAP QTS vulnerable to OS command injection
QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a flaw in the GNU Bash shell, which may result in an OS command injection vulnerability CWE-78. Impact A malicious attacker may be able to execute arbitrary command at the privilege level of the calling application. Solution Update...
VulnCheck KEV: CVE-2017-6361
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...
VulnCheck KEV: CVE-2017-6360
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...
CVE-2014-5457
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password...
Default credentials
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password...
CVE-2014-5457
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password...
CVE-2014-5457
CVE-2014-5457 affects QNAP TS-469U (firmware 4.0.7 Build 20140410) and related models TS-459U, TS-EC1679U-RP, SS-839. The root cause is world-readable permissions on /etc/config/shadow, enabling local users to read usernames and password hashes. This disclosure is documented across NVD/Red Hat/CV...
PT-2014-6487
Name of the Vulnerable Software and Affected Versions QNAP TS-469U version 4.0.7 Build 20140410 QNAP TS-459U affected versions not specified QNAP TS-EC1679U-RP affected versions not specified QNAP SS-839 affected versions not specified Description The issue allows local users to obtain usernames...
CVE-2014-5457: Undefined Security Weakness
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password...
QNAP Turbo NAS TS-1279U-RP Multiple Path Injection
No description provided by source. Exploit Title: QNAP Turbo NAS Multiple Path Injection Date: 2012-09-04 Exploit Author: Andrea Fabrizi Vendor Homepage: http://www.qnap.com/ Version: = 3.7.3 build 20120801 Tested on: QNAP TS-1279U-RP This vulnerability has been discovered on QNAP TS-1279U-RP, bu...
QNAP Turbo NAS 3.6.1 Build 0302T Multiple Vulnerabilities
No description provided by source. Sense of Security - Security Advisory - SOS-12-006 Release Date. 13-Jun-2012 Last Update. - Vendor Notification Date. 12-Mar-2012 Product. QNAP Platform. Turbo NAS verified and possibly others Affected versions. Firmware Version: 3.6.1 Build 0302T and prior...
CVE-2013-5760
QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...
Cross site request forgery (csrf)
QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...
CVE-2013-5760
QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...
CVE-2013-5760
CVE-2013-5760 affects QNAP Photo Station prior to firmware 4.0.3 build0912, where an request to photo/p/api/list.php allows remote attackers to enumerate OS user accounts. The description in the public records specifies an information-disclosure vulnerability (partial confidentiality) without det...
PT-2014-2955
Name of the Vulnerable Software and Affected Versions QNAP Photo Station versions prior to 4.0.3 build0912 Description The issue allows remote attackers to list OS user accounts via a request to "photo/p/api/list.php". Recommendations For versions prior to 4.0.3 build0912, update to firmware 4.0....
CVE-2013-5760: Exposure of Sensitive Information to an Unauthorized Actor
QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php...
CVE-2013-7174
Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...