Browse CVEs

CRITICAL 9.8 CVE-2017-17031 A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 2… Qts after 4.3.3.0378 Fix from $2,3002017-12-21 CRITICAL 9.8 CVE-2017-17032 A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 2… Qts after 4.3.3.0378 Fix from $2,3002017-12-21 CRITICAL 9.8 CVE-2017-17033 A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 2… Qts after 4.3.3.0378 Fix from $2,3002017-12-21 HIGH 7.8 CVE-2017-13070 A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitrary code o… Qsync after 4.2.2.0724 Fix from $1,9502017-12-11 CRITICAL 9.8 CVE-2017-13071 QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Station 5.1.3… Video Station Mitigation only Fix from $2,3002017-11-22 CRITICAL 9.8 CVE-2017-13069 QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earli… Music Station after 5.0.7 Fix from $2,3002017-10-06 HIGH 7.5 CVE-2017-13068 QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain… Qts Helpdesk after 1.1.12 Fix from $1,9502017-10-06 CRITICAL 9.8 CVE-2017-10700 In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of … Qts Mitigation only Fix from $2,3002017-09-19 CRITICAL 9.8 CVE-2017-13067EPSS 17% QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.… Qts after 4.3.3.0299 Fix from $2,3002017-09-14 CRITICAL 9.8 CVE-2017-12582 Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivile… Ts 212p Firmware Mitigation only Fix from $2,3002017-08-18 CRITICAL 10.0 CVE-2017-7876 This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the is… Qts after 4.2.6 Fix from $2,3002017-06-15 HIGH 7.5 CVE-2017-7629 QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function. Qts after 4.2.6 Fix from $1,9502017-06-15 CRITICAL 9.8 CVE-2017-6359EPSS 27% QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors. Qts after 4.2.4 Fix from $2,3002017-03-23 CRITICAL 9.8 CVE-2017-6360EPSS 66% QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. Qts after 4.2.4 Fix from $2,3002017-03-23 CRITICAL 9.8 CVE-2017-6361EPSS 57% QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Qts after 4.2.4 Fix from $2,3002017-03-23 HIGH 7.5 CVE-2017-5227EPSS 6% QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR forma… Qts after 4.2.4 Fix from $1,9502017-03-23 MEDIUM 6.1 CVE-2015-5664 Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via … Qts after 4.1.4 Fix from $1,6002016-07-03 CRITICAL 9.8 CVE-2015-7261 The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it … Iartist Lite after 2.0 Fix from $2,3002016-02-27 HIGH 7.5 CVE-2015-7262 QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges by regis… Iartist Lite after 2.0 Fix from $1,9502016-02-27 HIGH 7.5 CVE-2015-6036 QNAP Signage Station before 2.0.1 allows remote attackers to bypass authentication, and consequently upload files, via a spoofed HTTP request. Sinage Station Mitigation only Fix from $1,9502016-02-27 HIGH 8.8 CVE-2015-6022 Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading … Signage Station after 2.0 Fix from $1,9502016-02-27 HIGH 9.3 CVE-2015-6003 Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attac… Qts after 4.2.0 Fix from $1,9502015-10-16 MEDIUM 5.0 CVE-2013-5760 QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php. Photo Station Firmware after 4.0.3 Fix from $1,6002014-06-09 HIGH 7.8 CVE-2013-7174 Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname … Qts after 4.0.3 Fix from $1,9502014-01-09 MEDIUM 6.8 CVE-2013-0144 Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to… Viostor Network Video Recorder Mitigation only Fix from $1,6002013-06-07 MEDIUM 6.5 CVE-2013-0143EPSS 7% cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authen… Viostor Network Video Recorder Mitigation only Fix from $1,6002013-06-07 MEDIUM 5.0 CVE-2013-0142 QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows re… Viostor Network Video Recorder Mitigation only Fix from $1,6002013-06-07 MEDIUM 5.9 CVE-2009-3200 The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK … Ts 239 Pro Turbo Nas No fix yet Fix from $1,6002009-09-21 MEDIUM 5.5 CVE-2009-3278 The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery … Ts 239 Pro Firmware No fix yet Fix from $1,6002009-09-21