cve-2024-27130-poc

CVE-2024-27130-poc CVE-2024-27130 es una vulnerabilidad grave que afecta a los dispositivos de almacenamiento conectado en red NAS de QNAP. Esta vulnerabilidad se origina en el uso inseguro de la función strcpy en la función NoSupportACL del script share.cgi del sistema operativo QTS, lo que...

overkill

Overkill Overkill es un exploit para una vulnerabilidad parcheada que afecta a QNAP QTS. Debido a la forma en que QNAP divulga las vulnerabilidades, no estoy seguro de si este problema tiene un CVE o no. Sin embargo, probablemente fue parcheado en noviembre de 2020 y abril de 2021. El n-day fue...

CVE-2024-27130

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求所有被恐怖组织哈马斯劫持为人质的公民安全返回。在所有的人质获释并安全回家之前，我们决不罢休。您可以帮助他们回到家乡。https://stories.bringthemhomenow.net/ QNAP QTS CVE-2024-27130 PoC 🔒 本仓库包含一个针对 CVE-2024-27130 的验证性攻击脚本 PoC，该漏洞影响 QNAP QTS。此漏洞允许攻击者以 root 权限执行任意命令。 ⚠️ 描述 🔎 该脚本利用 QNAP QTS 中的一个漏洞，使攻击者能够以 root...

CVE-2024-53691

CVE-2024-53691 https://www.qnap.com/en/security-advisory/qsa-24-28 https://vulners.com/cve/CVE-2024-53691 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.7 "如果被利用，此链接跟随漏洞可能允许已获得用户访问权限的远程攻击者遍历文件系统到非预期位置。" 发现日期： 22 April 2024 修复日期： 7 September 2024 受影响版本： QTS 5.1.x, QuTS hero h5.1...

CVE-2023-47218

CVE-2023-47218 CVE-2023-47218: Iniezione di comando non autenticata in QNAP QTS e QuTS Hero RISOLTO POC root@kitploit: POST /cgi-bin/quick/quick.cgi?func=switchos&todo=uploaffirmwareimage HTTP/1.1 Host: 192.168.86.42:8080 User-Agent: Mozilla Macintosh Accept: / Content-Length: 164 Content-Type:...

Qnap QTS and QuTS hero Cross-site Scripting (CVE-2026-41539)

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS...

QNAP Systems QTS和QNAP Systems QuTS hero 操作系统命令注入漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. Both products have an operating system command injection vulnerability. This vulnerability stems from command injection, which...

QNAP QTS 安全漏洞

QNAP Systems QTS is a software with data storage and management capabilities developed by QNAP Systems, a company based in Taiwan, China. Versions of QNAP Systems QTS prior to 5.2.7.3256 contained a security vulnerability. This vulnerability stemmed from command injection, which could allow remot...

QNAP Systems QTS和QNAP Systems QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. Both QNAP Systems QTS and QNAP Systems QuTS hero have security vulnerabilities; these vulnerabilities stem from command injecti...

Qnap QTS and QuTS hero Buffer Copy without Checking Size of Input (CVE-2025-48725)

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: QuTS hero...

QNAP Systems QTS和QNAP Systems QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS Hero are both software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. There were security vulnerabilities in versions of QNAP Systems QTS 5.2.8.3332 and QNAP Systems QuTS Hero h5.2.8.3321. The...

Qnap QTS and QuTS hero Exposure of Sensitive Information to an Unauthorized Actor (CVE-2024-13086)

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-62852)

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Q...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-52426)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-53405)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero Out-of-bounds Read (CVE-2025-54166)

An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-53590)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero Use of Externally-Controlled Format String (CVE-2025-53591)

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

Qnap QTS and QuTS hero Improper Limitation of a Pathname to a Restricted Directory (CVE-2023-51365)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions:...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-52853)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...