CVE-2025-29894

CVE-2025-29894 affects QNAP Qsync Central. The vulnerability is an SQL injection in Qsync Central that can be exploited by an authenticated remote attacker to execute unauthorized commands. The issue is addressed in Qsync Central 4.5.0.7 and later. Affected component: Qsync Central (private cloud...

CVE-2025-29890 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2025-29888

CVE-2025-29888 affects QNAP File Station 5. A NULL pointer dereference vulnerability can be exploited remotely by an attacker who has a user account to cause a denial-of-service. The issue impacts File Station 5 and is fixed in version 5.5.6.4907 and later. Descriptions from multiple sources cons...

CVE-2025-29886

CVE-2025-29886 affects QNAP File Station 5. The vulnerability is a NULL pointer dereference that can be exploited by a remote attacker who has a user account to cause a denial-of-service. The issue is mitigated by updating to File Station 5 5.5.6.4907 or later. Multiple connected sources corrobor...

CVE-2025-29879 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29878 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2024-12923 Photo Station

A cross-site scripting XSS vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: Photo...

PT-2025-35284

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An improper certificate validation issue exists in Qsync Central. A remote attacker gaining a user account can compromise system security. Recommendations: Update to Qsync Central version...

PT-2025-35285

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An improper certificate validation issue exists in Qsync Central. A remote attacker gaining a user account can compromise system security. Recommendations: Update to Qsync Central version...

PT-2025-35268

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4907 Description: An allocation of resources without limits or throttling issue exists in File Station 5. If a remote attacker gains a user account, they can exploit this issue to prevent other systems,...

PT-2025-35270

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An allocation of resources without limits or throttling issue exists in Qsync Central. A remote attacker gaining a user account can exploit this to prevent other systems, applications, or...

PT-2025-35276

Name of the Vulnerable Software and Affected Versions: QNAP versions prior to QTS 5.2.5.3145 build 20250526 QNAP versions prior to QuTS hero h5.2.5.3138 build 20250519 Description: A NULL pointer dereference issue exists in QNAP operating systems. A remote attacker gaining a user account can...

PT-2025-35256

Name of the Vulnerable Software and Affected Versions: File Station versions prior to 5.5.6.4907 Description: A NULL pointer dereference issue exists in File Station 5. A remote attacker who has obtained a user account can exploit this issue to initiate a denial-of-service DoS attack...

CVE-2025-29901

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29901

CVE-2025-29901 affects QNAP File Station 5. A NULL pointer dereference vulnerability could allow a remote attacker who has a user account to cause a denial-of-service on affected systems. The issue is rooted in File Station 5 (versions prior to 5.5.6.4933). A fixed release is available: File Stat...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests. Remediation Upgrade...

CVE-2025-47206

An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later...

August 19, 2025—KB5066187 (OS Build 17763.7683) Out-of-band

None None...

PT-2025-33647 · Unknown · File Station 5

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4933 Description: An out-of-bounds write vulnerability affects File Station 5. If a remote attacker gains a user account, they can exploit the vulnerability to modify or corrupt memory. Recommendations:...

Linux Distros Unpatched Vulnerability : CVE-2022-32746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module,...