Cross site scripting

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and...

CVE-2021-44054

CVE-2021-44054: Open redirect in QNAP devices running QuTScloud, QuTS hero, and QTS. Affects QuTScloud, QuTS hero (h5.0.0.1949+; build 20220215+) and (h4.5.4.1951; build 20220218+), as well as QTS (5.0.0.1986; build 20220324+) and (4.5.4.1991; build 20220329+). Root cause described as an open red...

CVE-2021-44053

CVE-2021-44053 is a cross-site scripting (XSS) vulnerability affecting QNAP devices running QTS, QuTS hero, and QuTScloud. The issue allows remote attackers to inject malicious code. Fixed in QTS 4.5.4.1991 build 20220329 and later, QTS 5.0.0.1986 build 20220324 and later, QuTS hero h5.0.0.1986 b...

CVE-2021-44053 Reflected XSS

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and...

CVE-2021-44052 Arbitrary file read

An improper link resolution before file access 'Link Following' vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the...

CVE-2021-44052

CVE-2021-44052 affects QNAP devices running QuTScloud, QuTS hero, and QTS. It is an improper link resolution before file access ("link following") vulnerability that could allow remote attackers to traverse the file system and read or overwrite files in unintended locations. Affected components a...

CVE-2021-44051 Command injection

A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS:...

CVE-2021-44051

CVE-2021-44051 affects QNAP NAS running QTS, QuTS hero, and QuTScloud (remote command execution via a command-injection flaw). The NVD entry lists CVSS v3.1 base score 8.8 (high) with network access, low attack complexity, and no user interaction required; impact to confidentiality, integrity, an...

CVE-2021-38693 Path Traversal in thttpd

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the...

CVE-2021-38693

CVE-2021-38693 is a path-traversal vulnerability affecting QNAP devices running QuTScloud, QuTS hero, QTS, and QVR Pro Appliance. The issue is triggered via path traversal in thttpd, enabling read access to potentially sensitive files. Public references in the provided documents confirm remediati...

PT-2022-3429 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QuTScloud versions prior to c5.0.1.1949 QuTS hero versions prior to h5.0.0.1986 build 20220324 QTS versions prior to 5.0.0.1986 build 20220324 Description: A command injection issue affects QNAP NAS running QuTScloud, QuTS hero, and QTS,...

PT-2022-3427 · Qnap · Qts +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.4.1991 build 20220329 QTS versions prior to 5.0.0.1986 build 20220324 QuTS hero versions prior to h4.5.4.1971 build 20220310 QuTS hero versions prior to h5.0.0.1986 build 20220324 QuTScloud versions prior to...

QNAP 多款产品路径遍历漏洞

QNAP Systems QNAP QuTScloud is a cloud-optimized version of the QNAP NAS operating system from QNAP Systems. A path traversal vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud, which stems from an input validation error when processing a directory traversal sequence in thttpd. A remote...

QNAP Systems 多款产品命令注入漏洞

QNAP Systems QUTS Hero and others are products of China Weilian QNAP Systems.QUTS Hero is a NAS operating system for managing files.QNAP QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an entry- to mid-level operating system for use with QNAP NAS. A...

QNAP Systems 多款产品跨站脚本漏洞

QNAP Systems QUTS Hero and QNAP QuTScloud are both products of China Weilian QNAP Systems.QUTS Hero is a NAS operating system for file management. The system retains the application ecosystem of QTS and integrates the more powerful 128-bit ZFS file system to provide enterprises with a more stable...

PT-2022-3433

Name of the Vulnerable Software and Affected Versions QuTScloud versions prior to c5.0.1.1949 QuTS hero versions prior to h5.0.0.1949 build 20220215 and h4.5.4.1951 build 20220218 QTS versions prior to 5.0.0.1986 build 20220324 and 4.5.4.1991 build 20220329 QVR Pro Appliance affected versions not...

CVE-2021-44054: URL Redirection to Untrusted Site

An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of...

CVE-2021-44052: Improper Link Resolution Before File Access

An improper link resolution before file access 'Link Following' vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the...

CVE-2021-44053: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and...

CVE-2021-44051: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS:...