Qnap QTS Improper Authorization (CVE-2023-50363)

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS OS Command Injection (CVE-2024-21906)

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823...

Qnap QTS OS Command Injection (CVE-2024-21898)

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build...

Qnap QTS NULL Pointer Dereference (CVE-2023-41274)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service DoS attack via a network. We have already fixed the vulnerability in the following...

Qnap QTS Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2018-0721)

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710. This plug...

Qnap QTS Out-of-bounds Read (CVE-2022-27598)

A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP QVR Pro appliances...

Qnap QTS SQL Injection (CVE-2023-47568)

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 2024011...

SUSE SLES15 / openSUSE 15 Security Update : keepalived (SUSE-SU-2024:3634-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3634-1 advisory. - CVE-2024-41184: Fixed integer overflow in vrrpipsetshandler bsc1228123 Tenable has extracted the preceding description block directly fr...

Amazon Corretto Java 17.x < 17.0.13.11.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 17 17.0.13.11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2024-Oct-15 advisory. - core-libs/java.net CVE-2024-21208 - hotspot/compiler CVE-2024-21210, CVE-2024-21235 -...

Qnap QTS Exposure of Sensitive Information to an Unauthorized Actor (CVE-2017-7630)

QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information firmware version and running services via a request to sysinfoReq.cgi. This plugin only works with Tenable.ot. Please visit...

Qnap QTS Incorrect Permission Assignment for Critical Resource (CVE-2024-21902)

An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the...

SUSE SLES15 Security Update : kernel RT (Live Patch 0 for SLE 15 SP6) (SUSE-SU-2024:3628-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3628-1 advisory. This update for the Linux Kernel 6.4.0-1506008 fixes several issues. The following security issues were fixed: - CVE-2024-35861: Fixed potentia...

Qnap QTS Out-of-bounds Write (CVE-2023-41273)

A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533...

Qnap QTS OS Command Injection (CVE-2017-6360)

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, In...

Qnap QTS Path Traversal (CVE-2023-45026)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in...

Qnap QES Use of Hard-coded Credentials (CVE-2020-2499)

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later. This plugin only works with Tenable.ot...

Qnap QTS OS Command Injection (CVE-2023-39294)

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578...

Qnap QTS Stack-based Buffer Overflow (CVE-2024-27130)

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build...

Photon OS 4.0: Redis PHSA-2024-4.0-0700

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0700. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Qnap QTS Path Traversal (CVE-2013-7174)

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...