Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

682 records

TI-2022-10581 CVE-2022-27593 · GHSA-c84w-pfmp-9cxg

DeadBolt Ransomware

Priority CRITICAL 100KEV

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.87908 Published 2022-09-08 Fixed in 6.1.2, 6.0.22 +3 CWE-610
TI-2021-09791 CVE-2021-28799 · GHSA-4v9x-j7pr-8wxq

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Priority CRITICAL 100KEV

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.7825 Published 2021-05-13 Fixed in v16.0.0415, v3.0.210412 +3 CWE-285
TI-2020-02221 CVE-2020-2509 · GHSA-77jf-5mcg-g6m9

Command Injection Vulnerability in QTS and QuTS hero

Priority CRITICAL 100KEV

A command injection vulnerability has been reported to affect QTS and QuTS hero.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33987 Published 2021-04-17 Fixed in 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123 +5 CWE-77
TI-2019-05103 CVE-2019-7195 · GHSA-5h7g-3542-fw4q

Path traversal in QNAP NAS devices running Photo Station

Priority CRITICAL 100KEV

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89323 Published 2019-12-05 No fix listed CWE-22
TI-2019-05102 CVE-2019-7194 · GHSA-4wch-cg8h-vqc6

Path traversal in QNAP NAS devices running Photo Station

Priority CRITICAL 100KEV

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82713 Published 2019-12-05 No fix listed CWE-22
TI-2019-05101 CVE-2019-7193 · GHSA-964w-hfj4-c2g7

Improper input validation in QNAP NAS devices

Priority CRITICAL 100KEV

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14367 Published 2019-12-05 No fix listed CWE-20
TI-2018-14137 CVE-2018-19949 · GHSA-h9cw-v634-8jcw

Improper input validation in QNAP QTS

Priority CRITICAL 100KEV

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3016 Published 2020-10-28 Fixed in 4.4.2.1231, 4.4.1.1201 +4 CWE-20
TI-2014-05975 CVE-2014-7169 · GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed…

Priority CRITICAL 100KEV

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9994 Published 2014-09-25 Fixed CWE-78
TI-2014-05157 CVE-2014-6271 · GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values…

Priority CRITICAL 100KEV

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2014-09-24 Fixed CWE-78
TI-2020-02218 CVE-2020-2506 · GHSA-vph4-5mf4-28v5

improper access control vulnerability in Helpdesk

Priority CRITICAL 99KEV

The vulnerability have been reported to affect earlier versions of QTS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02006 Published 2021-02-03 Fixed in 3.0.3 CWE-284
TI-2023-25733 CVE-2023-47565 · GHSA-vj55-4r38-w2gh

Legacy VioStor NVR

Priority CRITICAL 97KEV

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.73277 Published 2023-12-08 Fixed in 5.0.0 CWE-78
TI-2018-14131 CVE-2018-19943 · GHSA-wh89-fj9h-4gr8

Cross-site scripting in QNAP QTS

Priority CRITICAL 94KEV

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.22682 Published 2020-10-28 Fixed in 4.4.2.1270, 4.4.1.1261 +4 CWE-79
TI-2018-14141 CVE-2018-19953 · GHSA-8h8x-7j55-4jp9

Cross-site scripting in QNAP QTS

Priority CRITICAL 86KEV

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.30527 Published 2020-10-28 Fixed in 4.4.2.1231, 4.4.1.1201 +4 CWE-79
TI-2023-25536 CVE-2023-47218 · GHSA-j269-5p85-wxpq

Command injection in QNAP QTS

Priority HIGH 79

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.8992 Published 2024-02-13 Fixed in 5.1.5.2645 build 20240116, 4.x +3 CWE-77
TI-2024-35889 CVE-2024-53691 · GHSA-6hfr-hxpf-c7m6

Link following in QNAP QTS

Priority HIGH 73

A link following vulnerability has been reported to affect several QNAP operating system versions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.23758 Published 2024-12-06 Fixed in 5.1.8.2823 build 20240712, 5.2.0.2802 build 20240620 +2 CWE-59
TI-2024-17986 CVE-2024-27130 · GHSA-c3mm-2w2h-vx43

Buffer overflow in QNAP QTS

Priority HIGH 73

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.3752 Published 2024-05-21 Fixed in 5.1.7.2770 build 20240520, h5.1.7.2770 build 20240520 CWE-120
TI-2024-14559 CVE-2024-21899 · GHSA-mfjq-7ffc-qgmv

Improper authentication in QNAP QTS

Priority HIGH 70

An improper authentication vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24365 Published 2024-03-08 Fixed in 5.1.3.2578 build 20231110, 4.5.4.2627 build 20231225 +3 CWE-287
TI-2023-09214 CVE-2023-23368 · GHSA-vccx-mhx2-8xvf

OS command injection in QNAP QTS

Priority HIGH 67

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18363 Published 2023-11-03 Fixed in 5.0.1.2376 build 20230421, 4.5.4.2374 build 20230416 +3 CWE-78
TI-2018-00662 CVE-2018-0707 · GHSA-8q8r-2j3c-9r4v

OS command injection in QNAP Q'center Virtual Appliance

Priority HIGH 66

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.58798 Published 2018-07-16 No fix listed CWE-78
TI-2023-28022 CVE-2023-51364 · GHSA-pvq7-259f-j6f4

Path traversal in QNAP QTS

Priority HIGH 65

A path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.39663 Published 2024-04-26 Fixed in 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225 +3 CWE-22
Load more
Open these records in search →