QNAP QTS < 4.2.4 Build 20170313 Multiple Vulnerabilities - Active Check

QNAP QTS web user interface is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection

QNAP QTS multiple RCE vulnerabilities ===================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/qnap-qts-multiple-rce-vulnerabilities.txt Overview -------- QNAP QTS firmware contains multiple Command Injection CWE-77 vulnerabilities...

QNAP QTS Remote Command Injection

QNAP QTS multiple RCE vulnerabilities ===================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/qnap-qts-multiple-rce-vulnerabilities.txt Overview -------- QNAP QTS firmware contains multiple Command Injection CWE-77 vulnerabilities...

The vulnerability of the QTS operating system allows a perpetrator to obtain confidential information and elevate their privileges to that of the system administrator.

The vulnerability of the QTS operating system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to obtain confidential information and elevate their privileges to those of the system administrator using undefined vectors...

The vulnerability of the QTS operating system, allowing a perpetrator to execute arbitrary commands

The vulnerability of the QTS operating system is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using uncertain vectors...

The vulnerability of the QTS operating system allows a perpetrator to execute arbitrary commands and elevate their privileges to that of the system administrator.

The vulnerability of the QTS operating system is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and increase their privileges to that of the system administrator using undefined vectors...

QNAP QTS 4.2.4 - Domain Privilege Escalation

QNAP QTS 4.2.4 - Domain Privilege Escalation QNAP QTS Domain Privilege Escalation Vulnerability Name Sensitive Data Exposure in QNAP QTS Systems Affected QNAP QTS NAS all model and all versions 4.2.4 Severity High 7.9/10 Impact CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Vendor...

QNAP QTS < 4.2.4 - Domain Privilege Escalation

QNAP QTS Domain Privilege Escalation Vulnerability Name Sensitive Data Exposure in QNAP QTS Systems Affected QNAP QTS NAS all model and all versions 4.2.4 Severity High 7.9/10 Impact CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Vendor http://www.qnap.com/ Advisory...

CVE-2017-5227

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

Design/Logic Flaw

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

Command injection

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

Information disclosure

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors...

Command injection

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

CVE-2017-5227

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file...

CVE-2017-6361

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

CVE-2017-6359

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors...

CVE-2017-6361

QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors...

CVE-2017-5227

CVE-2017-5227 affects QNAP QTS prior to 4.2.4 Build 20170313. Local (non‑remote) users can read data stored in XOR format inside /etc/config/uLinux.conf to obtain sensitive Domain Administrator password information. The available connected documents consistently describe the same effect and targe...

CVE-2017-6359

CVE-2017-6359 affects QNAP QTS prior to 4.2.4 Build 20170313. The QTS web UI CGI binaries permit unauthenticated command injection, enabling an attacker to gain administrator/root privileges and execute arbitrary commands via unspecified vectors. Public references include Exploit-DB (exploit 4184...

CVE-2017-6361

QNAP QTS firmware versions before 4.2.4 Build 20170313 are vulnerable to a Command Injection (CWE-77) flaw in the web user interface CGI binaries. Specifically, the authLogin.cgi component is susceptible because the reboot_notice_msg HTTP request GET parameter is passed directly to system() calls...