CVE-2018-19941

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 bui...

CVE-2018-19941

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 bui...

Design/Logic Flaw

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 bui...

CVE-2018-19941 Cleartext Storage of Sensitive Information in Cookies

A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 bui...

CVE-2018-19941

CVE-2018-19941 affects QNAP NAS devices, enabling an attacker to read sensitive information stored in cleartext cookies. Concrete details in connected sources show the affected products and fixed versions: QTS 4.5.1.1456 build 20201015 (and later); QuTS hero h4.5.1.1472 build 20201031 (and later)...

Improper access control

Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...

CVE-2020-29189

CVE-2020-29189 affects TerraMaster TOS

TerraMaster TOS Remote Code Execution Vulnerability

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A remote code execution vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. An attacker can exploit this vulnerability to execute commands without authentication via shell...

Terramaster TOS Security Vulnerability

Terramaster TOS is a Linux-based operating system from Shenzhen, China-based Tumi Electronic Technology Terramaster dedicated to the erraMaster Cloud Storage NAS server. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by an attacker t...

Western Digital My Cloud Multiple Products 5.0 < 5.07.118 Authentication Bypass Vulnerability

Multiple Western Digital My Cloud products are prone to an authentication bypass vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-29563

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device...

CVE-2020-29563

CVE-2020-29563 affects Western Digital My Cloud OS 5 devices prior to 5.07.118. The issue is a NAS Admin authentication bypass that could allow an unauthenticated user to gain access to the device. Public sources in the connected set describe remote authentication bypass affecting the My Cloud PR...

QNAP Systems Cross-Site Scripting Vulnerability in Multiple Products

Qnap Systems QNAP QTS is a Turbo NAS operating system from Qnap Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A cross-site scripting vulnerability exists in several QNAP Systems products, which can be exploited by an attacker to...

QNAP High-Severity Flaws Plague NAS Systems

QNAP Systems is warning of high-severity flaws that plague its top-selling network attached storage NAS devices. If exploited, the most severe of the flaws could allow attackers to remotely take over NAS devices. NAS devices are systems that consist of one or more hard drives that are constantly...

Western Digital My Cloud Multiple Products 5.0 < 5.06.115 Multiple Vulnerabilities

Multiple Western Digital My Cloud products are prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...

CVE-2020-28940

The CVE concerns Western Digital My Cloud PR4100 NAS running My Cloud OS 5 prior to 5.06.115. The nasAdmin service (listening on TCP ports 80/443) contains an incorrect string-matching flaw that allows an unauthenticated user to bypass authentication and execute commands with root privileges. Imp...

CVE-2020-28971

Summary : Western Digital My Cloud OS 5 devices prior to 5.06.115 are affected by a NAS Admin authentication bypass in the nasAdmin service due to insufficient URI-path validation. This enables unauthenticated attackers to execute privileged commands on the device, with ZDI noting potential arbit...

Western Digital My Cloud OS devices Authorization Issues Vulnerability

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 devices prior to version 5.06.115, which stems from an authentication bypass vulnerability in the NAS management dashboard that could allow an...

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer memory limit, allowing attackers to escalate their privileges.

The vulnerability of Western Digital MyCloud NAS’ network storage software relates to writing beyond the buffer limits of memory. Exploiting this vulnerability can allow a remote attacker to gain elevated privileges...

The vulnerability of the cgi_api.php component in the network storage software from Western Digital’s MyCloud NAS allows a perpetrator to execute arbitrary code.

The vulnerability of the cgiapi.php component in the Western Digital MyCloud NAS network storage software is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...