Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 5 of 6
Aug 24, 2023An insufficient entropy vulnerability has been reported to affect QNAP operating systems.CVE-2023-34973 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.1
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems.CVE-2023-34972 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.5
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems.CVE-2023-34971 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).CVE-2021-28025 · Other software · QT · reported by MITREMedium 5.5
Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0, 6.0.2, and 6.2, allows local attackers to cause a denial of service (DoS).
- Product
- QT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugreports.qt.iobugreports.qt.io
May 10, 2023In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.CVE-2023-32573 · Other software · QT · reported by MITREMedium 6.5
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
- Product
- QT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orglists.debian.org
Mar 29, 2023A vulnerability has been reported to affect QNAP operating systems.CVE-2022-27598 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.7
A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023A vulnerability has been reported to affect QNAP operating systems.CVE-2022-27597 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.7
A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023An OS command injection vulnerability has been reported to affect QNAP operating systems.CVE-2023-23355 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.6
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023A vulnerability has been reported to affect QNAP device running QuTS hero, QTS.CVE-2022-27596 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2.CVE-2022-43591 · Other software · Qt Project · reported by talos-cna@cisco.comHigh 8.8
A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds memory access, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 12, 2023An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2.CVE-2022-40983 · Other software · Qt Project · reported by talos-cna@cisco.comHigh 8.8
An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer overflow during memory allocation, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 5, 2022An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS.CVE-2021-44054 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud.CVE-2021-44053 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.7
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS.CVE-2021-44052 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.5
An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS.CVE-2021-44051 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance.CVE-2021-38693 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later
- Product
- QuTScloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud.CVE-2021-38674 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.2
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
- Product
- QuTS hero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2021Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called frCVE-2021-45930 · Other software · QT · reported by MITREMedium 5.5
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
- Product
- Qtsvg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Sep 10, 2021A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero.CVE-2021-34343 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero.CVE-2021-28816 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud.CVE-2018-19957 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021A command injection vulnerabilities have been reported to affect QTS and QuTS hero.CVE-2021-28804 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021A command injection vulnerabilities have been reported to affect QTS and QuTS hero.CVE-2021-28802 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2020-36194 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS.CVE-2021-28800 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.1
A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28806 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.7
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28798 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2021An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on.CVE-2020-36195 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2021A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station.CVE-2018-19942 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021The vulnerability have been reported to affect earlier versions of QTS.CVE-2020-2507 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021A command injection vulnerability has been reported to affect QTS and QuTS hero.CVE-2020-2508 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6.CVE-2018-19945 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.1
A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices.CVE-2018-19944 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed this vulnerability in the following versions: QTS 4.4.3.1354 build 20200702 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A vulnerability has been reported to affect QNAP NAS.CVE-2018-19941 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2020This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application.CVE-2020-25847 · Network & remote access · QNAP Systems Inc. · reported by twcert@cert.org.twHigh 8.8
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration.CVE-2020-2498 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs.CVE-2020-2497 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station.CVE-2020-2496 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station.CVE-2020-2495 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application.CVE-2019-7198 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands.CVE-2020-2492 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands.CVE-2020-2490 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019QNAP QTS Improper Input Validation VulnerabilityCVE-2019-7193 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
- Product
- QTS
- On CISA’s list since
- Jun 8, 2022 (federal fix deadline Jun 22, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comqnap.com
Dec 5, 2019This improper link resolution vulnerability allows remote attackers to access system files.CVE-2019-7183 · Network & remote access · Qnap · reported by security@qnapsecurity.com.twCritical 9.8
This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS.CVE-2019-7197 · Network & remote access · Qnap · reported by security@qnapsecurity.com.twMedium 4.8
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019This command injection vulnerability in File Station allows attackers to execute commands on the affected device.CVE-2018-0730 · Network & remote access · Qnap · reported by security@qnapsecurity.com.twCritical 9.8
This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2019Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allCVE-2018-0722 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twHigh 7.5
Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2018Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 aCVE-2018-0716 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twMedium 6.1
Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2018Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions couCVE-2018-14749 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS.
- Product
- QNAP QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2018Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versiCVE-2018-14748 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twHigh 7.5
Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS.
- Product
- QNAP QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.