CVE-2023-45035

CVE-2023-45035 is a buffer copy vulnerability in QNAP QTS/QuTS OSes that can allow authenticated administrators to execute code over the network. According to the sources, the issue affects QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1...

CVE-2023-45028

CVE-2023-45028 is an reported uncontrolled resource consumption vulnerability affecting multiple QNAP OS families (QTS, QuTS hero, QuTScloud). The issue allows authenticated administrators to trigger a network-based denial-of-service (DoS). Affected versions are fixed in QTS 5.1.5.2645/build 2024...

CVE-2023-45027

CVE-2023-45027 is a path-traversal vulnerability affecting multiple QNAP OS lines: QTS, QuTS hero, and QuTScloud. The issue could allow an authenticated administrator to read contents of unexpected files and exfiltrate sensitive data over the network. Fixes are available in: QTS 5.1.5.2645 build ...

CVE-2023-45026

CVE-2023-45026 is a path traversal vulnerability reported to affect several QNAP OS lines (QTS, QuTS Hero, QuTScloud). The issue could allow authenticated administrators to read contents of unintended files and expose sensitive data over a network. Fixed in QTS 5.1.5.2645 build 20240116 and later...

CVE-2023-45025

CVE-2023-45025 is an OS command injection affecting QNAP QTS and QuTS Hero/QS Cloud products. Affected versions include QTS 5.1.4.2596+ (build 20231128+), QTS 4.5.4.2627+ (build 20231225+), QuTS Hero h5.1.4.2596+ (build 20231128+), QuTS Hero h4.5.4.2626+ (build 20231225+), and QuTScloud c5.1.5.26...

CVE-2023-41292

CVE-2023-41292 concerns a buffer copy without input size validation in QNAP firmware. The issue can allow authenticated administrators to execute code over the network. Affected products include QTS, QuTS hero, and QuTScloud, with root cause described as a buffer overrun during input handling. Im...

CVE-2023-41283

Summary of CVE-2023-41283 (QNAP OS command injection) : An OS command injection vulnerability affecting multiple QNAP OS versions has been reported. If exploited, authenticated administrators could execute commands over the network. The issue has been fixed in: QTS 5.1.4.2596 build 20231128 and l...

CVE-2023-41281

CVE-2023-41281 is an OS command injection vulnerability affecting QNAP QTS, QuTS hero, and QuTScloud. Authenticated administrators could execute commands over the network on affected OS versions. QNAP reports fixes in QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 a...

CVE-2023-41279

CVE-2023-41279 affects QNAP QTS/QTS Hero/QuTScloud. It is described as a stack/_buffer type issue where a buffer copy without input size checking could allow an authenticated administrator to execute code over the network. Fixed versions are QTS 5.1.2.2533 build 20230926 and later, QuTS Hero h5.1...

CVE-2023-41278

CVE-2023-41278 affects multiple QNAP platforms (QTS, QuTS hero, QuTScloud): a buffer copy without input size checking could allow an authenticated administrator to execute code over the network. The issue has been fixed in QTS 5.1.2.2533+ (build 20230926+), QuTS hero h5.1.2.2534+ (build 20230927+...

CVE-2023-41277

CVE-2023-41277 is a buffer copy vulnerability in QNAP QTS/QuTS products. Affected: QTS 5.1.2.2533 build 20230926 and later; QuTS hero h5.1.2.2534 build 20230927 and later; QuTScloud c5.1.5.2651 and later. Root cause: a buffer copy without checking input size. Impact: remotely exploitable by an au...

CVE-2023-41276

CVE-2023-41276 describes a buffer copy without input size validation that affects multiple QNAP OS lines. Affected products include QTS, QuTS hero, and QuTScloud. The underlying issue allows an authenticated administrator to execute code over the network. Fixed in QTS 5.1.2.2533+ (build 20230926+...

CVE-2023-39303

CVE-2023-39303 describes an improper authentication vulnerability in QNAP OSes (QTS, QuTS hero, QuTScloud) that could allow network-based compromise of the system. Affected products include QTS 5.1.3.2578+ (build 20231110 and later), QuTS hero h5.1.3.2578+ (build 20231110 and later), and QuTSclou...

CVE-2023-39297

CVE-2023-39297 is an OS command injection affecting several QNAP OS versions. The root cause is command execution via the network by authenticated users. Impact is high: confidentiality, integrity, and availability are all rated high (CVSS v3.1: 8.8). Affected products include QTS and QuTS Hero/C...

CVE-2023-39302

CVE-2023-39302 is an OS command injection vulnerability in several QNAP OS versions. Affected products include QTS, QuTS hero, and QuTScloud. The root cause is command execution via the network by an authenticated administrator. Impact is described as high in CVSS terms; exploitation requires net...

CVE-2023-32967

CVE-2023-32967 is an incorrect authorization vulnerability affecting several QNAP OS versions (excluding QTS 5.x and QuTS Hero). It could allow an authenticated user to bypass access restrictions over the network. Fixed in QuTScloud r5.1.5.2651+ and QTS 4.5.4.2627 build 20231225+. Guidance: upgra...

CVE-2024-24757

CVE-2024-24757 affects the open-irs repository bot where an ".env" file was accidentally uploaded during git actions, revealing sensitive keys. This exposure is documented across multiple sources (NVD entry with CVSS v3.1 base score 9.8; Red Hat entry; PT-Security). The root cause is an accidenta...

CVE-2024-23831

LedgerSMB vulnerability CVE-2024-23831 allows privilege escalation by tricking a database administrator in an active /setup.pl session into submitting a request that creates a new admin user via /login.pl. This is rooted in insufficient verification when HTML fragments are processed during setup,...

CVE-2024-1185

CVE-2024-1185 affects Nsasoft NBMonitor Network Bandwidth Monitor 1.6.5.0, specifically the Registration Handler. The issue allows a locally approached denial of service due to a vulnerability in that component. Public exploit information is indicated, and the vendor reportedly did not respond to...

CVE-2022-34381

CVE-2022-34381 is referenced in connected documents as a vulnerability affecting Oracle Enterprise Manager Base Platform components (notably the BSAFE Crypto-J element) within Oracle Enterprise Manager Cloud Control OL/CPU advisories. The Nessus entry for October 2024 CPU notes that 13.5.0.0 of E...