Path traversal

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in...

Command injection

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578...

Authorization

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected. We have already fixed the...

Cross site scripting

A cross-site scripting XSS vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 2023/12/15 and later...

Command injection

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645...

Input validation

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

Code injection

An unchecked return value vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated administrators to place the system in a state that could lead to a crash or other unintended behaviors via unspecified vector...

Input validation

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

Heap overflow

A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533...

Null pointer dereference

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service DoS attack via a network. We have already fixed the vulnerability in the following...

Security feature bypass

Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability...

Path traversal

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in...

Sql injection

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 2024011...

Command injection

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later...

Buffer overflow

A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution...

CVE-2023-50359

CVE-2023-50359 affects QNAP QTS and QuTS hero: an unchecked return value vulnerability could allow a local authenticated administrator to place the system in a crash or other unintended state via unspecified vectors. Root cause and impact are described in multiple sources as affecting several QNA...

CVE-2023-47568

CVE-2023-47568 is a SQL injection vulnerability reported for several QNAP OS lines (QTS, QTS Hero, QuTS, QuTScloud). The issue allows an authenticated user to inject malicious code via a network, indicating a server-side injection in affected components exposed to network input. The vulnerability...

CVE-2023-47567

CVE-2023-47567 is an OS command injection affecting multiple QNAP OS lines. The vulnerability could allow authenticated administrators to execute commands over the network. Public artifacts list fixes in specific releases: QTS 5.1.5.2645 build 20240116 and later; QTS 4.5.4.2627 build 20231225 and...

CVE-2023-47566

CVE-2023-47566 is an OS command injection affecting several QNAP OS versions (QTS, QuTS hero, QuTScloud). The vulnerability could allow authenticated administrators to execute commands over the network. The specification provides concrete fixes: QTS 5.1.5.2645 build 20240116 and later; QuTS hero ...

CVE-2023-45036

CVE-2023-45036 affects QNAP QTS/QTS Hero/QuTScloud. A buffer copy without checking input size could allow an authenticated administrator to execute code over the network. Remediations are in place: QTS 5.1.3.2578/build 20231110 and later; QuTS hero h5.1.3.2578/build 20231110 and later; QuTScloud ...