QNAP operating system 代码问题漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

CVE-2025-30247

CVE-2025-30247 is an OS command injection in the web UI of Western Digital My Cloud NAS on firmware prior to 5.31.108. A remote attacker can execute arbitrary system commands via a specially crafted HTTP POST. Affected products are Western Digital My Cloud firmware versions before 5.31.108. The C...

PT-2025-39899

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud versions prior to 5.31.108 Description An OS command injection flaw exists in the user interface of the firmware. This issue allows remote attackers to execute arbitrary system commands by sending a specially crafted...

Dell PowerScale OneFS 信息泄露漏洞

DELL PowerScale OneFS is a horizontally scalable NAS Network Attached Storage operating system from Dell Technologies that is primarily used to manage massive amounts of unstructured data. An information disclosure vulnerability exists in DELL PowerScale OneFS that originates from unauthorized...

CVE-2023-53389

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached The MediaTek DisplayPort interface bridge driver starts its interrupts as soon as its probed. However when the interrupts trigger the bridge might not have been...

CVE-2023-53389 drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached The MediaTek DisplayPort interface bridge driver starts its interrupts as soon as its probed. However when the interrupts trigger the bridge might not have been...

CVE-2023-53389

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached The MediaTek DisplayPort interface bridge driver starts its interrupts as soon as its probed. However when the interrupts trigger the bridge might not have been...

kernel: drm/gem: Acquire references on GEM handles for framebuffers

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. 1...

Metabase 0.41.x < 0.41.7 / 0.42.x < 0.42.4 / 1.41.x < 1.41.7 / 1.42.x < 1.42.4

The version of Metabase installed on the remote host is prior to Unknown. It is, therefore, affected by a Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the...

CVE-2025-38732

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfreject: don't leak dst refcount for loopback packets recent patches to add a WARN when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 inlin...

CVE-2025-39717 open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE

In the Linux kernel, the following vulnerability has been resolved: opentreeattr: do not allow id-mapping changes without OPENTREECLONE As described in commit 7a54947e727b 'Merge patch series "fs: allow changing idmappings"', opentreeattr2 was necessary in order to allow for a detached mount to b...

CVE-2025-38732

CVE-2025-38732 refers to a Linux kernel vulnerability in netfilter nf_reject where loopback packets could cause a dst refcount leak. The issue arises from a patch that added a WARN during skb dst entry replacement but forgot that loopback packets already have a dst_entry attached (even at PRE_ROU...

CVE-2025-38732 netfilter: nf_reject: don't leak dst refcount for loopback packets

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfreject: don't leak dst refcount for loopback packets recent patches to add a WARN when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 inlin...

Malicious code in building-attached-food (npm)

The package building-attached-food was found to contain malicious code...

MAL-2025-43674 Malicious code in building-attached-food (npm)

The package building-attached-food was found to contain malicious code...

bpf: Prevent tail call between progs attached to different hooks

...

QNAP QTS and QuTS hero out-of-bounds write vulnerabilities

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

QNAP QTS and QuTS hero null pointer dereference vulnerability (CNVD-2025-27747)

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

QNAP QTS和QNAP QuTS hero 路径遍历漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...

QNAP QTS和QNAP QuTS hero 路径遍历漏洞

QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...