QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the OLDPASSWORD parameter provided to the changepassword.cgi endpoint. The...

QNAP QTS authLogin Host Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within authLogin.cgi. When parsing the Host header, the process does not properly validate the lengt...

QNAP QTS Web sysinfoReq Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the lang parameter provided to the sysinfoReq.cgi endpoint. The issue results...

QNAP QTS Web devRequest Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within devRequest.cgi. When parsing the password parameter, the process does not properly validate t...

QNAP QTS NASFTPD USER Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS NASFTPD. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NASFTPD service, which listens on TCP port 21 by default. When parsing the USER...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37607)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37606)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Unauthenticated Remote Code Execution(CVE-2017-17033)

Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. “specializes in providing networked solutions for file sharing,...

QNAP QTS < 4.2.6 build 20171208, 4.3.3.x < 4.3.3.0396 build 20171205, 4.3.4.x < 4.3.4.0411 build 20171208 Multiple Vulnerabilities

QNAP QTS is vulnerable to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

QNAP QTS 4.2.x < 4.2.6 build 20170905, 4.3.x < 4.3.3 build 20170727 Command Injection Vulnerability

QNAP QTS is vulnerable to a command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

CVE-2017-13071

QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Station 5.1.3 for QTS 4.3.3, 5.2.0 for QTS 4.3.4, and earlier...

CVE-2017-13069

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 for QTS 4.2.x, 5.0.7 for QTS 4.3.x, and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS...

CVE-2017-13069: Improper Neutralization of Special Elements used in a Command

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 for QTS 4.2.x, 5.0.7 for QTS 4.3.x, and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS...

QNAP QTS 'Media Library' Command injection Vulnerability

QNAP QTS is prone to a command execution vulnerability. This VT was deprecated since it is a duplicate of QNAP NAS SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-13067

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port...

CVE-2017-13067

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port...

Remote code execution

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port...

CVE-2017-13067

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port...

CVE-2017-13067

Summary of CVE-2017-13067 : A remote code execution flaw in the QNAP QTS Media Library. Affects QTS versions prior to 4.2.6 (build 20170905) and 4.3.3.0299 (build 20170901). The vulnerability enables an unauthenticated attacker to execute commands on a QNAP NAS via a transcoding service listening...

PT-2017-12906

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.2.6 build 20170905 QNAP QTS versions prior to 4.3.3.0299 build 20170901 Description The issue allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does...