Update now! QNAP warns users DeadBolt is exploiting Photo Station vulnerability

QNAP Quality Network Appliance Provider has warned users to update Photo Station to the latest available version. The warning comes after QNAP detected that cybercriminals known as DeadBolt have been exploiting a Photo Station vulnerability in order to encrypt QNAP NAS systems that are directly...

Vulnerabilities fixed in QNAP products

QNAP has fixed several vulnerabilities in QTS, the operating system of QNAP NAS systems. The vulnerabilities are are in the SAMBA and Kerberos software used within QTS. used within. The vulnerabilities allow a remote malicious person to able to bypass security measures and thus gain access gain...

QNAP QTS Installed

Binary data qnapqtsinstalled.nbin...

QNAP Poisoned XML Command Injection (Silently Patched)

Background CVE-2020-2509 was added to CISA’s Known Exploited Vulnerabilities Catalog in April 2022, and it was listed as one of the “Additional Routinely Exploited Vulnerabilities in 2021” in CISA’s 2021 Top Routinely Exploited Vulnerabilities alert. However, CVE-2020-2509 has no public exploit,...

The vulnerability of the QTS operating system, specifically the QuTS Hero operating system, arises from the lack of measures taken to neutralize special elements used in the command line of the operating system. This allows attackers to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of the QTS operating system is related to the lack of measures taken to neutralize special elements used in the OS command line. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of information...

The vulnerability of the QuTS operating system, specifically the QTS operating system, is related to the use of open redirection. This allows attackers to compromise the confidentiality and integrity of information.

The vulnerability of the QuTS operating system, specifically the QTS operating system, is related to the use of open redirection. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality and integrity of information...

The vulnerability of the QTS operating system lies in its inability to neutralize special elements used in the OS command line, allowing attackers to execute arbitrary commands.

The vulnerability of the QTS operating system is related to the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the QTS operating system, related to the lack of measures taken to protect the structure of the web page, allows attackers to execute arbitrary code.

The vulnerability of the QTS operating system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Critical PHP Vulnerability Exposes QNAP NAS Devices to Remote Attacks

QNAP, Taiwanese maker of network-attached storage NAS devices, on Wednesday said it's in the process of fixing a critical three-year-old PHP vulnerability that could be abused to achieve remote code execution. "A vulnerability has been reported to affect PHP versions 7.1.x below 7.1.33, 7.2.x bel...

QNAP QTS 4.3.6 < 4.3.6 build 20190919 / 4.4.1 < 4.4.1 build 20190918 Multiple Vulnerabilities (NAS-201911-25)

The version of QNAP QTS installed on the remote host is affected by multiple vulnerabilities, as follows: - An improper input validation vulnerability that allows remote attackers to inject arbitrary code to the system. CVE-2019-7193 - Two external control of file name or path vulnerabilities tha...

QNAP QTS Improper Input Validation Vulnerability

QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system...

QNAP QTS Command Injection (CVE-2018-19949)

A command injection vulnerability exists in QNAP QTS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2021-34360

A cross-site request forgery CSRF vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy...

CVE-2021-34360

A cross-site request forgery CSRF vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy...

CVE-2021-34360 CSRF Bypass in Proxy Server

A cross-site request forgery CSRF vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy...

QNAP QTS Multiple Vulnerabilities in File Station (QSA-20-01)

The version of QNAP QTS installed on the remote host is affected by multiple vulnerabilities, as follows: - A vulnerability that allows remote attackers to run arbitrary commands. CVE-2018-19949 - Two cross-site scripting XSS vulnerabilities that allow remote attackers to inject malicious code...

QNAP Urges Users to Update NAS Devices to Prevent Deadbolt Ransomware Attacks

Taiwanese network-attached storage NAS devices maker QNAP on Thursday warned its customers of a fresh wave of DeadBolt ransomware attacks. The intrusions are said to have targeted TS-x51 series and TS-x53 series appliances running on QTS 4.3.6 and QTS 4.4.1, according to its product security...

QNAP QTS Path Traversal Vulnerability (QSA-22-13)

QNAP QTS is prone to a path traversal vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

Vulnerabilities fixed in QNAP QTS, QuTS hero and QuTScloud

QNAP has fixed vulnerabilities in QTS, QuTS hero and QuTScloud. The vulnerabilities potentially enable a malicious party to execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights Access to sensitive data Access to system data...

CVE-2021-38693

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the...