Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 4 of 6
Apr 26, 2024An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-50363 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.4
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-50362 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-50361 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024An injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-21900 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024An improper authentication vulnerability has been reported to affect several QNAP operating system versions.CVE-2024-21899 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-34980 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.9
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-50358 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.8
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QTS 4.3.6.2665 build 20240131 and later QTS 4.3.4.2675 build 20240131 and later QTS 4.3.3.2644 build 20240131 and later QTS 4.2.6 build 20240131 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunit42.paloaltonetworks.combsi.bund.de
Feb 12, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-47218 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.8
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An unchecked return value vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-50359 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.4
An unchecked return value vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated administrators to place the system in a state that could lead to a crash or other unintended behaviors via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A SQL injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-47568 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-47567 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.7
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-47566 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.7
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45037 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45036 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45035 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45028 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A path traversal vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45027 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A path traversal vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45026 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45025 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41292 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41283 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41282 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41281 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41280 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41279 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41278 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41277 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41276 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41275 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41274 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-41273 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An improper authentication vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39303 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39302 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.6
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39297 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45040 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-45039 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024A prototype pollution vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39296 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2024An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39294 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.6
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32975 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.9
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.2.2534 build 20230927 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32968 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.5
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.2.2534 build 20230927 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-23372 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.5
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h4.5.4.2476 build 20230728 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-23367 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.7
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-39301 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2023An OS command injection vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-23368 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023A path traversal vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32974 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32973 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32972 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.CVE-2023-32971 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.8
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2023A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system.CVE-2023-23363 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.1
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2023An OS command injection vulnerability has been reported to affect QNAP operating systems.CVE-2023-23362 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.