Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
805 results · page 9 of 17
Feb 11, 2022An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server.CVE-2021-38679 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.5
An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.22 and later
- Product
- Kazoo Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2022A flaw was found in the REST API in StarWind Stack.CVE-2022-24552 · Other software · Starwindsoftware · reported by MITRECritical 9.8
A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.
- Product
- NAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarwindsoftware.comstarwindsoftware.com
Feb 6, 2022A flaw was found in StarWind Stack.CVE-2022-24551 · Other software · Starwindsoftware · reported by MITREHigh 8.8
A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any local user password (including system/administrator user) using any available user This affects StarWind SAN and NAS v0.2 build 1633.
- Product
- NAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstarwindsoftware.comstarwindsoftware.com
Jan 28, 2022laminas-form is a package for validating and displaying simple and complex forms.CVE-2022-23598 · Other software · laminas · reported by GitHubMedium 6.1
laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
- Product
- laminas-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetlaminas.orggithub.com
Jan 28, 2022A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unseCVE-2022-22994 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 8.8
A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.
- Product
- My Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comzerodayinitiative.com
Jan 13, 2022A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP callCVE-2022-22991 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 7.8
A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.
- Product
- My Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comzerodayinitiative.com
Jan 13, 2022Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon MobileCVE-2021-30301 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 29, 2021A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station.CVE-2021-38687 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.1
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later
- Product
- Surveillance Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.CVE-2021-45257 · Other software · Nasm · reported by MITREMedium 5.5
An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Dec 22, 2021A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.CVE-2021-45256 · Other software · Nasm · reported by MITREMedium 5.5
A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Nov 30, 2021This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS.CVE-2020-7879 · Other software · EFM networks & multimedia · reported by vuln@krcert.or.krHigh 8.8
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
- Product
- ipTIME C200 IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB.CVE-2021-38681 · Other software · Negocios · reported by security@qnapsecurity.com.twMedium 5.3
A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security patch from Ragic.
- Product
- Ragic Cloud DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console.CVE-2021-38684 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.1
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later
- Product
- Multimedia Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, SnapdragCVE-2021-30284 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Nov 12, 2021Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivityCVE-2021-1982 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 30, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station.CVE-2021-34355 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud.CVE-2018-19957 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'.CVE-2020-18974 · Other software · Nasm · reported by MITRELow 3.3
Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue is different than CVE-2019-7147.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Aug 24, 2021The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remoCVE-2021-38613 · Other software · Nascent · reported by MITRECritical 9.8
The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution.
- Product
- Remkon Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblacklanternsecurity.comnascent.com
Aug 24, 2021In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read anCVE-2021-38612 · Other software · Nascent · reported by MITREHigh 7.5
In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL.
- Product
- Remkon Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblacklanternsecurity.comnascent.com
Aug 24, 2021A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as rCVE-2021-38611 · Other software · Nascent · reported by MITRECritical 9.8
A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php.
- Product
- Remkon Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblacklanternsecurity.comnascent.com
Aug 22, 2021In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to CVE-2021-39365 · Other software · Gnome · reported by MITREMedium 5.9
In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
- Product
- Grilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.gnome.orggitlab.gnome.org
Jul 9, 2021Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI anCVE-2021-32972 · Other software · Panasonic · reported by ics-cert@hq.dhs.govMedium 5.5
Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.
- Product
- Fpwin Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 30, 2021A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center.CVE-2020-36196 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0.
- Product
- QuLog Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2020-36194 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.CVE-2021-20740 · Other software · Hitachi and NEC Corporation · reported by vultures@jpcert.or.jpHigh 8.8
Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.
- Product
- Hitachi Virtual File Platform and NEC Storage M Series NAS Gateway which uses Hitachi Virtual File Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2021A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS.CVE-2021-28800 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.1
A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link.CVE-2021-28815 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.
- Product
- myQNAPcloud Link
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021An improper access control vulnerability has been reported to affect QNAP NAS.CVE-2021-28814 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center.CVE-2021-28807 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later
- Product
- Q’center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28806 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.7
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero.CVE-2021-28798 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2021QNAP NAS Improper Authorization VulnerabilityCVE-2021-28799 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
- Product
- Network Attached Storage (NAS)
- On CISA’s list since
- Mar 31, 2022 (federal fix deadline Apr 21, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogqnap.comqnap.com
Apr 17, 2021An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on.CVE-2020-36195 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2021QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityCVE-2020-2509 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedCritical 9.8
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
- Product
- QNAP Network-Attached Storage (NAS)
- On CISA’s list since
- Apr 11, 2022 (federal fix deadline May 2, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogqnap.comqnap.com
Apr 14, 2021A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station.CVE-2021-28797 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
- Product
- Surveillance Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2021RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service in Snapdragon Auto, SCVE-2020-11243 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 23, 2021The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code executioCVE-2020-7847 · Other software · EFM Networks · reported by vuln@krcert.or.krHigh 7.4
The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.
- Product
- ipTIME NAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2021A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station.CVE-2020-2501 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
- Product
- Surveillance Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2021An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content.CVE-2021-26939 · Other software · Henriquedornas · reported by MITREHigh 7.5
An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. NOTE: third parties report that this is a site-specific problem
- Product
- Henriquedornas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.opensuse.orggithub.com
Feb 10, 2021A stored XSS issue exists in henriquedornas 5.2.17 via online live chat.CVE-2021-26938 · Other software · Henriquedornas · reported by MITREMedium 5.4
A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts
- Product
- Henriquedornas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted requestCVE-2021-20623 · Other software · Panasonic Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.
- Product
- Video Insight VMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an attacker to remotely exeCVE-2020-16236 · Other software · Panasonic · reported by ics-cert@hq.dhs.govHigh 7.8
FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, which may allow an attacker to remotely execute arbitrary code.
- Product
- FPWIN Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jan 5, 2021Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports.CVE-2020-29490 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service (Storage Processor Panic) by sending specially crafted UDP requests.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2021Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content CVE-2021-3007 · Other software · Getlaminas · reported by MITRECritical 9.8
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
- Product
- Laminas-http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020A vulnerability has been reported to affect QNAP NAS.CVE-2018-19941 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative coCVE-2020-29194 · Other software · Panasonic · reported by MITREHigh 7.5
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative control) via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/set_factory URI.
- Product
- Wv-s2231l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.panasonic.com
Dec 28, 2020Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order).CVE-2020-29193 · Other software · Panasonic · reported by MITREMedium 6.8
Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order).
- Product
- Wv-s2231l Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.panasonic.com
Dec 15, 2020In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value.CVE-2020-0486 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege to change contact data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150857116
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 14, 2020OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attacCVE-2020-28861 · Other software · Openasset · reported by MITREMedium 5.3
OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application.
- Product
- Digital Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.