Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
QnapQts4.2.6

26 matches found

CVE
CVE•added 2021/04/17 4:15 a.m.•1128 views

CVE-2020-2509

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later ...

9.8CVSS9.8AI score0.84258EPSS
CVE
CVE•added 2020/10/28 6:15 p.m.•957 views

CVE-2018-19949

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20...

9.8CVSS9.6AI score0.57621EPSS
CVE
CVE•added 2020/10/28 6:15 p.m.•951 views

CVE-2018-19943

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS...

8CVSS5.5AI score0.05768EPSS
CVE
CVE•added 2020/10/28 6:15 p.m.•951 views

CVE-2018-19953

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build ...

6.1CVSS6AI score0.40146EPSS
CVE
CVE•added 2022/05/05 5:15 p.m.•98 views

CVE-2021-44051

A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScl...

8.8CVSS8.9AI score0.01801EPSS
CVE
CVE•added 2022/05/05 5:15 p.m.•90 views

CVE-2021-44054

An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTSclou...

6.1CVSS5.2AI score0.00208EPSS
CVE
CVE•added 2022/05/05 5:15 p.m.•79 views

CVE-2021-44053

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScl...

6.1CVSS5.7AI score0.00332EPSS
CVE
CVE•added 2018/11/28 4:29 p.m.•74 views

CVE-2018-14746

Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS.

10CVSS9.7AI score0.04785EPSS
CVE
CVE•added 2022/05/05 5:15 p.m.•68 views

CVE-2021-44052

An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the conte...

8.1CVSS7AI score0.00289EPSS
CVE
CVE•added 2021/04/16 1:15 a.m.•65 views

CVE-2018-19942

A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) Q...

6.1CVSS6AI score0.0027EPSS
CVE
CVE•added 2023/11/03 5:15 p.m.•60 views

CVE-2023-23369

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions:Multimedia Console 2.1.2 ( 2023/05/04 ) an...

9.8CVSS9.6AI score0.14766EPSS
CVE
CVE•added 2018/11/27 11:29 p.m.•57 views

CVE-2018-0721

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.

10CVSS7.8AI score0.00633EPSS
CVE
CVE•added 2024/09/06 5:15 p.m.•56 views

CVE-2023-39300

An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions:QTS 4.3.6.2805 build 20240619 and laterQTS 4.3....

7.2CVSS7.2AI score0.00236EPSS
CVE
CVE•added 2018/11/28 4:29 p.m.•50 views

CVE-2018-14749

Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS.

9.8CVSS9.7AI score0.00543EPSS
CVE
CVE•added 2019/12/05 5:15 p.m.•44 views

CVE-2019-7183

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.

9.8CVSS9.3AI score0.01246EPSS
CVE
CVE•added 2018/06/21 1:29 p.m.•43 views

CVE-2018-0712

Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.

9.8CVSS9.7AI score0.02732EPSS
CVE
CVE•added 2018/11/27 9:0 p.m.•41 views

CVE-2018-0719

Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions ...

5.5CVSS5.4AI score0.00226EPSS
CVE
CVE•added 2019/12/04 5:16 p.m.•41 views

CVE-2019-7197

A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.

4.8CVSS4.9AI score0.0031EPSS
CVE
CVE•added 2018/03/27 9:29 p.m.•40 views

CVE-2017-7631

Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.

6.1CVSS6.1AI score0.0025EPSS
CVE
CVE•added 2018/11/30 2:29 p.m.•40 views

CVE-2018-0716

Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.

6.1CVSS6.2AI score0.00272EPSS
CVE
CVE•added 2018/06/21 1:29 p.m.•39 views

CVE-2017-13072

Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.

6.1CVSS6AI score0.00272EPSS
CVE
CVE•added 2018/03/27 9:29 p.m.•38 views

CVE-2017-7632

Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.

6.1CVSS6AI score0.0025EPSS
CVE
CVE•added 2018/03/27 9:29 p.m.•37 views

CVE-2017-7630

QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and running services) via a request to sysinfoReq.cgi.

5.3CVSS5AI score0.0023EPSS
CVE
CVE•added 2019/12/04 5:16 p.m.•37 views

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

9.8CVSS9.7AI score0.01203EPSS
CVE
CVE•added 2018/11/28 4:29 p.m.•33 views

CVE-2018-14747

NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server.

7.5CVSS7.9AI score0.006EPSS
CVE
CVE•added 2018/11/28 4:29 p.m.•33 views

CVE-2018-14748

Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS.

7.8CVSS7.9AI score0.00622EPSS