CVE-2025-29898

CVE-2025-29898 affects QNAP Qsync Central. Affected component: Qsync Central software. Vulnerability: uncontrolled resource consumption that enables a remote attacker who has a user account to trigger a denial-of-service (DoS). Impact per reported metrics includes high availability impact with ne...

CVE-2025-29898 Qsync Central

An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Centra...

CVE-2025-29894 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

CVE-2025-29894

CVE-2025-29894 affects QNAP Qsync Central. The vulnerability is an SQL injection in Qsync Central that can be exploited by an authenticated remote attacker to execute unauthorized commands. The issue is addressed in Qsync Central 4.5.0.7 and later. Affected component: Qsync Central (private cloud...

CVE-2025-29894 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

CVE-2025-29893 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

CVE-2025-29893

The CVE-2025-29893 issue affects QNAP Qsync Central and is caused by an SQL injection vulnerability from lack of validation of externally entered SQL statements. A remote attacker who has a user account could exploit this to execute unauthorized code or commands. The vulnerability is rated HIGH (...

CVE-2025-29893 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

QNAP Qsync Central 安全漏洞

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. A denial of service vulnerability exists in QNAP Qsync Central, which stems from uncontrolled resource consumption and can...

QNAP Qsync Central 路径遍历漏洞

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. A path traversal vulnerability exists in QNAP Qsync Central, which can be exploited by an attacker to read unexpected file...

PT-2025-35287

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: A path traversal vulnerability exists in Qsync Central. A remote attacker gaining a user account can potentially read the contents of unexpected files or system data. Recommendations: Updat...

CVE-2025-30260: Allocation of Resources Without Limits or Throttling

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We hav...

PT-2025-35289

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: A path traversal vulnerability exists in Qsync Central. A remote attacker who has gained a user account can exploit this vulnerability to read the contents of unexpected files or system dat...

PT-2025-35267

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 4.5.0.7 Description An uncontrolled resource consumption issue exists in Qsync Central. A remote attacker gaining a user account can launch a denial-of-service DoS attack. Recommendations Update to Qsync Central...

PT-2025-35283

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: A NULL pointer dereference issue exists in Qsync Central. A remote attacker gaining a user account can exploit this to launch a denial-of-service DoS attack. Recommendations: Update to Qsyn...

CVE-2025-30261: Allocation of Resources Without Limits or Throttling

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We hav...

PT-2025-35285

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.5.0.7 Description: An improper certificate validation issue exists in Qsync Central. A remote attacker gaining a user account can compromise system security. Recommendations: Update to Qsync Central version...

PT-2025-35271

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 5.0.0.0 Description: An allocation of resources without limits or throttling issue exists in Qsync Central. A remote attacker gaining a user account can exploit this to prevent other systems, applications, or...

CVE-2025-33036: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2025-30262: NULL Pointer Dereference

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.0...