CVE-2021-38693

CVE-2021-38693 is a path-traversal vulnerability affecting QNAP devices running QuTScloud, QuTS hero, QTS, and QVR Pro Appliance. The issue is triggered via path traversal in thttpd, enabling read access to potentially sensitive files. Public references in the provided documents confirm remediati...

QNAP Systems 多款产品跨站脚本漏洞

QNAP Systems QUTS Hero and QNAP QuTScloud are both products of China Weilian QNAP Systems.QUTS Hero is a NAS operating system for file management. The system retains the application ecosystem of QTS and integrates the more powerful 128-bit ZFS file system to provide enterprises with a more stable...

PT-2022-3428 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QuTS hero versions prior to h4.5.4.1971 build 20220310 QuTS hero versions prior to h5.0.0.1986 build 20220324 QTS versions prior to 4.2.6 build 20220304 QTS versions prior to 4.3.3.1945 build 20220303 QTS versions prior to 4.3.4.1976 build...

PT-2022-3429 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QuTScloud versions prior to c5.0.1.1949 QuTS hero versions prior to h5.0.0.1986 build 20220324 QTS versions prior to 5.0.0.1986 build 20220324 Description: A command injection issue affects QNAP NAS running QuTScloud, QuTS hero, and QTS,...

PT-2022-3457 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QuTScloud versions prior to c5.0.1.1949 QuTS hero versions prior to h5.0.0.1949 build 20220215 and prior to h4.5.4.1951 build 20220218 QTS versions prior to 5.0.0.1986 build 20220324 and prior to 4.5.4.1991 build 20220329 Description: An open...

QNAP 多款产品路径遍历漏洞

QNAP Systems QNAP QuTScloud is a cloud-optimized version of the QNAP NAS operating system from QNAP Systems. A path traversal vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud, which stems from an input validation error when processing a directory traversal sequence in thttpd. A remote...

QNAP Systems 多款产品命令注入漏洞

QNAP Systems QUTS Hero and others are products of China Weilian QNAP Systems.QUTS Hero is a NAS operating system for managing files.QNAP QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an entry- to mid-level operating system for use with QNAP NAS. A...

QNAP QTS / QuTS hero Improper Authorization Vulnerability in HBS 3 (QSA-21-13)

The version of QNAP QTS or QuTS hero on the remote host is affected by an improper authorization vulnerability when running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. Note that Nessus has not tested for this issue but has instead relie...

PT-2022-3427 · Qnap · Qts +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.4.1991 build 20220329 QTS versions prior to 5.0.0.1986 build 20220324 QuTS hero versions prior to h4.5.4.1971 build 20220310 QuTS hero versions prior to h5.0.0.1986 build 20220324 QuTScloud versions prior to...

QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available

Network-attached storage NAS appliance maker QNAP on Wednesday said it's working on updating its QTS and QuTS operating systems after Netatalk last month released patches to contain seven security flaws in its software. Netatalk is an open-source implementation of the Apple Filing Protocol AFP,...

QNAP QTS / QuTS Hero Default Credentials

The remote QNAP QTS or QuTS Hero web administration interface uses a known set of hard-coded default credentials. An attacker can exploit this to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

QNAP QTS / QuTS hero Command Injection (QSA-21-05)

The version of QNAP QTS or QuTS hero on the remote host is affected by a command injection vulnerability. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. Note that Nessus has not tested for this issue but has instead relied only on the...

QNAP QTS / QuTS hero Multiple Buffer Overflow Vulnerabilities (QSA-21-33)

The version of QNAP QTS or QuTS hero on the remote host is affected by multiple stack buffer overflow vulnerabilities. A remote, authenticated attacker can exploit this to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the application's...

QNAP QTS / QuTS hero Buffer Overflow (QSA-21-50)

The version of QNAP QTS or QuTS hero on the remote host is affected by a heap-based buffer overflow vulnerability in devices that have Apple File Protocol AFP enabled. This allows attackers to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on th...

QNAP QTS / QuTS hero Out-of-Bounds Read (QSA-21-27)

The version of QNAP QTS or QuTS hero on the remote host is affected by an SMB out-of-bounds read vulnerability. An authenticated, remote attacker can exploit this to obtain sensitive information. Note that Nessus has not tested for this issue but has instead relied only on the application's...

QNAP QTS / QuTS hero Insufficient HTTP Security Headers (QSA-21-03)

The version of QNAP QTS or QuTS hero on the remote host is affected by a vulnerability involving insufficient HTTP security headers. This vulnerability allows remote attackers to launch privacy and security attacks. Note that Nessus has not tested for this issue but has instead relied only on the...

QNAP QTS / QuTS hero Information Disclosure (QSA-21-53)

The version of QNAP QTS or QuTS hero on the remote host is affected by an information disclosure vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable, Inc...

QNAP QTS / QuTS hero Multiple Vulnerabilities in Samba (QSA-22-03)

The version of QNAP QTS or QuTS hero on the remote host is affected by multiple vulnerabilities in the Samba component, as follows: - The Samba vfsfruit module uses extended file attributes EA, xattr to provide '...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk...

QNAP QTS / QuTS Hero Arbitrary Code Execution (QSA-21-57)

The version of QNAP QTS / QuTS Hero installed on the remote host is affected by an arbitrary code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Nessus has not tested for this issue but has instead...

QNAP QTS / QuTS Hero DEADBOLT Ransomware (QSA-22-02)

The version of QNAP QTS / QuTS Hero installed on the remote host is affected by an arbitrary code execution vulnerability which is being actively exploited by the DEADBOLT ransomware. The ransomware encrypts files, renames them with a .deadbolt extension and hijacks the login page with a ransom...