Sql injection

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and...

Cross site scripting

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651...

CVE-2024-21900 QTS, QuTS hero, QuTScloud

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and...

CVE-2024-21900

The CVE-2024-21900 entry describes an injection vulnerability affecting several QNAP operating system versions. Authenticated users could potentially execute commands over the network due to the underlying injection flaw. Affected product families include QTS, QuTS hero, and QuTScloud. Remediatio...

CVE-2024-21899 QTS, QuTS hero, QuTScloud

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578...

CVE-2024-21899

CVE-2024-21899 describes an improper authentication vulnerability affecting several QNAP operating system lines (QTS and QuTS variants). The connected sources specify impact on QTS 5.1.3.2578 build 20231110 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.3.2578 build 20231110 a...

CVE-2023-32969 Network & Virtual Switch

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651...

CVE-2023-32969

Summary (CVE-2023-32969) A cross-site scripting (XSS) vulnerability affects QNAP’s Network & Virtual Switch across multiple product lines (QuTScloud, QTS, QuTS hero). The issue allows authenticated administrators to inject malicious code via a network. Affected/fixed versions: QuTScloud c5.1.5.26...

CVE-2023-32969 Network & Virtual Switch

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651...

CVE-2023-34980 QTS, QuTS hero

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627...

QNAP Systems Multiple Product Security Vulnerabilities

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China's Weilian Technology QNAP Systems.QNAP Systems QTS is an operating system used by entry to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in multiple QNAP Systems products tha...

PT-2024-12488

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.5.4.2627 build 20231225 QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 Description An OS command injection issue has been reported, affecting several QNAP operating system versions. If exploited, this...

PT-2024-12372 · Qnap · Qutscloud +2

Name of the Vulnerable Software and Affected Versions: QuTScloud versions prior to 5.1.5.2651 QTS versions prior to 5.1.4.2596 build 20231128 QuTS hero versions prior to 5.1.4.2596 build 20231128 Description: A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual...

QNAP Systems Multiple Product Injection Vulnerabilities

QNAP Systems QuTScloud and others are products of China Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating system...

QNAP Systems Cross-Site Scripting Vulnerability in Multiple Products

QNAP Systems QuTScloud and others are products of China Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating system....

QNAP Systems Multiple Product Licensing Issues Vulnerabilities

QNAP Systems QuTScloud and others are products of China Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating system...

The vulnerability of QTS, QuTS hero, and QuTScloud network devices from Qnap operating systems arises from incorrect path name restrictions for access-controlled catalogs. This allows attackers to exploit the vulnerabilities to disclose protected information.

The vulnerability of QTS, QuTS Hero, and QuTScloud network devices from QNAP operating systems is related to incorrect path name restrictions in the restricted access catalog. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

QNAP QTS / QuTS hero Multiple Vulnerabilities in QTS, QuTS hero (QSA-23-38)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-38 advisory: - A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could...