QNAP QTS 4.2.0 Build 20160311 / Build 20160601 Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-048 Product: QNAP QTS Manufacturer: QNAP Affected Versions: 4.2.0 Build 20160311 and Build 20160601 Tested Versions: 4.2.0 Build 20160311 - 4.2.2 Build 20160812 Vulnerability Type: OS Command Injection CWE-78 Risk Level: High...

QNAP QTS 4.2.1 Build 20160601 Lang Parameter Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-054 Product: QNAP QTS Manufacturer: QNAP Affected Versions: 4.2.1 Build 20160601 Tested Versions: 4.2.1 Build 20160601 - 4.2.2 Build 20160812 Vulnerability Type: OS Command Injection CWE-78 Risk Level: High Solution Status:...

QNAP QTS File Station XSS Vulnerability

QNAP QTS File Station is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-5664

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5664

CVE-2015-5664 is a cross-site scripting (XSS) vulnerability in QNAP QTS File Station prior to 4.2.0. Multiple connected sources (JVN/JVNDB, CNVD, OpenVAS, Tenable/NASL) confirm that remote attackers can inject arbitrary script/HTML via unspecified vectors, potentially affecting web browser sessio...

CVE-2015-5664

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

QNAP QTS vulnerable to cross-site scripting

Overview QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Keigo YAMAZAKI of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

JVN#42930233: QNAP QTS vulnerable to cross-site scripting

QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Update to the latest version of firmware according to the information provided by the...

QNAP QTS Cross-Site Scripting Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A cross-site scripting vulnerability exists in QNAP QTS versions prior to 4.2.0. A remote attacker can exploit this vulnerability to...

CVE-2015-6003

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

Directory traversal

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

CVE-2015-6003

CVE-2015-6003 affects QNAP QTS (pre-4.1.4 build 0910 and pre-4.2.0 RC2 build 0910) where AFP enables a path traversal flaw allows remote attackers with OS X user or guest accounts to read/write arbitrary files. Root cause: directory traversal in AFP handling enables access due to insufficient pat...

CVE-2015-6003

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

QNAP QTS is vulnerable to a path traversal attack when used with the AFP protocol and OS X

Overview QNAP QTS is a Network-Attached Storage NAS system. The QNAP QTS is vulnerable to a path traversal attack when used with the AFP protocol and OS X. Description CWE-23: Relative Path Traversal - CVE-2015-6003 When the Apple Filing Protocol AFP is enabled, any OS X user account including th...

QNAP QTS vulnerable to OS command injection

Overview QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a flaw in the GNU Bash shell, which may result in an OS command injection vulnerability CWE-78. Yuuki Wakisaka of University of Electro-Communications reported this vulnerability to IPA. JPCERT/CC coordinated with the...

JVN#55667175: QNAP QTS vulnerable to OS command injection

QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a flaw in the GNU Bash shell, which may result in an OS command injection vulnerability CWE-78. Impact A malicious attacker may be able to execute arbitrary command at the privilege level of the calling application. Solution Update...

VulnCheck KEV: CVE-2017-6360

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

CVE-2013-7174

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

Path traversal

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

CVE-2013-7174

CVE-2013-7174 affects QNAP QTS prior to 4.1.0, via path traversal in the CGI script cgi-bin/jc.cgi . An unauthenticated remote attacker can read arbitrary files by supplying a full pathname in parameter f . The vulnerability is classified with base CVSS v2 score 7.8 (HIGH) under attack vector NET...