QNAP
Page 6 of 7 — QNAP CVEs from a corpus of 636, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-28814 | High | 8.8 | 2021-06-11 | An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the secur… |
CVE-2021-28805 | High | 7.8 | 2021-06-11 | Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows at… |
CVE-2021-28801 | Low | 3.1 | 2021-06-11 | An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read se… |
CVE-2021-28810 | High | 7.5 | 2021-06-08 | If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already… |
CVE-2021-28812 | High | 8.8 | 2021-06-03 | A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to ex… |
CVE-2021-28807 | High | 7.7 | 2021-06-03 | A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attacke… |
CVE-2021-28806 | Medium | 5.7 | 2021-06-03 | A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malic… |
CVE-2021-28798 | High | 8.8 | 2021-05-21 | A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to mo… |
CVE-2021-28799 | Critical | 10.0 | 2021-05-13 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote… |
CVE-2020-36198 | Medium | 6.7 | 2021-05-13 | A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to… |
CVE-2020-36197 | High | 7.1 | 2021-05-13 | An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to co… |
CVE-2020-36195 | Critical | 9.8 | 2021-04-17 | An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability a… |
CVE-2020-2509 | Critical | 9.8 | 2021-04-17 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2018-19942 | Medium | 6.1 | 2021-04-16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attacke… |
CVE-2021-28797 | Critical | 9.8 | 2021-04-14 | A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows… |
CVE-2020-2502 | Medium | 6.1 | 2021-02-17 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-2501 | Critical | 9.8 | 2021-02-17 | A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows… |
CVE-2020-2507 | Critical | 9.8 | 2021-02-03 | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run… |
CVE-2020-2506 | High | 7.3 | 2021-02-03 | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compr… |
CVE-2020-2508 | High | 7.2 | 2021-01-11 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2018-19944 | High | 7.5 | 2020-12-31 | A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remo… |
CVE-2018-19941 | High | 7.5 | 2020-12-31 | A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext i… |
CVE-2020-25847 | High | 8.8 | 2020-12-29 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-2505 | Low | 2.3 | 2020-12-24 | If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in Q… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2020-2503 | Critical | 9.0 | 2020-12-24 | If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed thes… |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-2498 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fix… |
CVE-2020-2497 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed… |
CVE-2020-2496 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2495 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2494 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the fo… |
CVE-2020-2493 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in M… |
CVE-2020-2491 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2019-7198 | Critical | 9.8 | 2020-12-10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2020-2492 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-2490 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2018-19956 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19955 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19954 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19951 | Medium | 6.1 | 2020-11-02 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Statio… |
CVE-2018-19950 | Critical | 9.8 | 2020-11-02 | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19953 | Medium | 6.1 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following… |
CVE-2018-19949 | Critical | 9.8 | 2020-10-28 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT… |
CVE-2018-19943 | High | 8.0 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the followi… |
CVE-2018-19948 | Low | 2.0 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow att… |
CVE-2018-19947 | Medium | 4.3 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive inf… |
CVE-2018-19946 | Medium | 4.2 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an at… |
CVE-2020-2500 | Critical | 9.8 | 2020-07-01 | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP… |
CVE-2013-6277 | High | 7.5 | 2020-02-13 | QNAP VioCard 300 has hardcoded RSA private keys. |
CVE-2019-7195 | Critical | 9.8 | 2019-12-05 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd… |
CVE-2019-7194 | Critical | 9.8 | 2019-12-05 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd… |
CVE-2019-7193 | Critical | 9.8 | 2019-12-05 | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating… |
CVE-2019-7192 | Critical | 9.8 | 2019-12-05 | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend upda… |
CVE-2019-7185 | Medium | 4.8 | 2019-12-05 | This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console… |
CVE-2019-7184 | Medium | 4.8 | 2019-12-05 | This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console… |
CVE-2019-7183 | Critical | 9.8 | 2019-12-05 | This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their lat… |
CVE-2019-7201 | High | 7.8 | 2019-12-04 | An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized bu… |
CVE-2019-7197 | Medium | 4.8 | 2019-12-04 | A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker… |
CVE-2018-0730 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upda… |
CVE-2018-0729 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upd… |
CVE-2018-0728 | High | 7.5 | 2019-12-04 | This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and He… |
CVE-2019-7181 | High | 7.5 | 2019-05-09 | Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program. |
CVE-2018-0722 | High | 7.5 | 2019-02-01 | Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could al… |
CVE-2018-0724 | Medium | 6.1 | 2018-12-26 | Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in… |
CVE-2018-0723 | Medium | 6.1 | 2018-12-26 | Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in… |
CVE-2018-0716 | Medium | 6.1 | 2018-11-30 | Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4… |
CVE-2018-14749 | Critical | 9.8 | 2018-11-28 | Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions co… |
CVE-2018-14748 | High | 7.5 | 2018-11-28 | Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier vers… |
CVE-2018-14747 | High | 7.5 | 2018-11-28 | NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier ve… |
CVE-2018-14746 | Critical | 9.8 | 2018-11-28 | Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions… |
CVE-2018-0721 | High | 7.7 | 2018-11-27 | Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior ver… |
CVE-2018-0719 | Medium | 5.5 | 2018-11-27 | Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. Q… |
CVE-2018-0718 | Critical | 9.8 | 2018-09-14 | Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands… |
CVE-2018-0715 | Medium | 6.1 | 2018-08-27 | Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised a… |
CVE-2018-0714 | Critical | 9.8 | 2018-08-13 | Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 an… |
CVE-2018-0710 | High | 8.8 | 2018-07-17 | Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary command… |
CVE-2018-0709 | High | 8.8 | 2018-07-17 | Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary comman… |
CVE-2018-0708 | High | 8.8 | 2018-07-17 | Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary… |
CVE-2018-0707 | High | 7.2 | 2018-07-17 | Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbit… |
CVE-2018-0706 | High | 8.8 | 2018-07-17 | Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. |
CVE-2018-0712 | Critical | 9.8 | 2018-06-21 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions… |
CVE-2017-13072 | Medium | 6.1 | 2018-06-21 | Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier… |
CVE-2017-7639 | Medium | 5.3 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of… |
CVE-2017-7637 | Critical | 9.8 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges. |
CVE-2017-7636 | Medium | 6.1 | 2018-06-05 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or H… |
CVE-2017-7635 | High | 8.8 | 2018-06-05 | QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections. |
CVE-2018-0711 | Medium | 6.1 | 2018-04-30 | Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to… |
CVE-2017-13073 | Medium | 6.1 | 2018-04-23 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers t… |
CVE-2017-7632 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inje… |
CVE-2017-7631 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows r… |
CVE-2017-7630 | Medium | 5.3 | 2018-03-27 | QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and r… |
CVE-2017-7641 | High | 8.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. |
CVE-2017-7640 | Critical | 9.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system w… |
CVE-2017-7638 | Medium | 6.5 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could le… |
CVE-2017-7634 | Medium | 6.1 | 2018-03-08 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to in… |
CVE-2017-7633 | High | 7.5 | 2018-03-05 | QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise… |
CVE-2017-17033 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 an… |