CVE-2018-19956

CVE-2018-19956 is a cross-site scripting (XSS) vulnerability affecting QNAP Photo Station. Affected are Photo Station versions before 5.7.11 and before 6.0.10. The issue arises from insufficient input validation in the Photo Station web application, enabling remote attackers to inject malicious c...

CVE-2018-19951

CVE-2018-19951 is a Cross-Site Scripting (XSS) vulnerability in QNAP Music Station web interface. The root cause is insufficient input validation by the Music Station web application, enabling remote attackers to inject client-side code. Affected versions are QNAP Music Station prior to 5.1.13, p...

CVE-2018-19955

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10...

CVE-2018-19952

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11...

CVE-2018-19956

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10...

CVE-2018-19954

CVE-2018-19954 is a cross-site scripting vulnerability in QNAP Systems Inc. Photo Station. Affected versions are Photo Station prior to 5.7.11 and prior to 6.0.10. The issue stems from insufficient input validation in the Web application, enabling remote attackers to inject malicious code if expl...

CVE-2018-19952

CVE-2018-19952 is a SQL injection vulnerability in QNAP Music Station that could allow remote attackers to obtain application information. Affected versions are Music Station prior to 5.1.13, prior to 5.2.9, and prior to 5.3.11. The root cause is an SQL injection flaw that enables data disclosure...

CVE-2018-19950

CVE-2018-19950 is a command injection vulnerability in QNAP Music Station that could allow a remote attacker to execute arbitrary commands over the network without authentication, affecting Music Station versions prior to 5.1.13, 5.2.9, and 5.3.11. Exploitation details are corroborated by multipl...

PT-2020-8658 · Qnap Systems · Music Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11 Description: This issue is a command injection vulnerability that could...

PT-2020-8662 · Synology · Photo Station

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 5.7.11 Photo Station versions prior to 6.0.10 Description: The issue is a cross-site scripting vulnerability that affects earlier versions of Photo Station, allowing remote attackers to inject malicious code if...

PT-2020-8663 · Qnap Systems · Photo Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Photo Station versions prior to 5.7.11 QNAP Systems Inc. Photo Station versions prior to 6.0.10 Description: A cross-site scripting issue has been reported, allowing remote attackers to inject malicious code if exploited...

PT-2020-8659 · Qnap Systems · Music Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11 Description: This issue is a cross-site scripting vulnerability that cou...

PT-2020-8661 · Qnap Systems · Photo Station

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Photo Station versions prior to 5.7.11 QNAP Systems Inc. Photo Station versions prior to 6.0.10 Description: The issue is a cross-site scripting vulnerability that could allow remote attackers to inject malicious code if...

Vulnerabilities fixed in QNAP QTS

Vulnerabilities have been fixed in QNAP-QTS, Music-Station and Photo-Station. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights SQL Injection Access to system data QNAP has...

CVE-2019-8572

A null pointer dereference was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution...

CVE-2019-8578

A use after free issue was addressed with improved memory management. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution...

CVE-2019-8575

The issue was addressed with improved data deletion. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A base station factory reset may not delete all user information...

CVE-2019-8581

An out-of-bounds read was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to leak memory...

CVE-2019-8588

A null pointer dereference was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause a system denial of service...

CVE-2019-8581

An out-of-bounds read was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to leak memory...