Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

13 records in Music Station · all components

TI-2020-18517 CVE-2020-36197 · GHSA-7mc6-7xwc-c4wg

Improper Access Control Vulnerability in Music Station

Priority MEDIUM 56

An improper access control vulnerability has been reported to affect earlier versions of Music Station.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.18497 Published 2021-05-13 Fixed in 5.3.16, 5.2.10 +1 CWE-284
TI-2018-00678 CVE-2018-0729 · GHSA-58wh-7jpg-vjqr

Command injection in QNAP NAS devices

Priority MEDIUM 47

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02341 Published 2019-12-04 No fix listed CWE-77
TI-2018-14138 CVE-2018-19950 · GHSA-rc96-pxf6-73c4

Command injection in QNAP Music Station

Priority MEDIUM 46

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02063 Published 2020-11-02 Fixed in 5.1.13, 5.2.9 +1 CWE-77
TI-2018-00671 CVE-2018-0718 · GHSA-gw52-pwgm-mrx7

Command injection in QNAP Music Station

Priority MEDIUM 45

Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01682 Published 2018-09-14 No fix listed CWE-77
TI-2023-24086 CVE-2023-45038 · GHSA-mp4c-v3vm-qr7w

Improper authentication in QNAP Music Station

Priority MEDIUM 41

An improper authentication vulnerability has been reported to affect Music Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01243 Published 2024-09-06 Fixed in 5.4.0 CWE-287
TI-2023-20443 CVE-2023-39299 · GHSA-227v-m6p6-j6gx

Path traversal in QNAP Music Station

Priority MEDIUM 40

A path traversal vulnerability has been reported to affect Music Station.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00733 Published 2023-11-03 Fixed in 4.8.11, 5.1.16 +1 CWE-22
TI-2023-09212 CVE-2023-23366 · GHSA-wx23-v95c-hhrq

Path traversal in QNAP Music Station

Priority LOW 35

A path traversal vulnerability has been reported to affect Music Station.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00668 Published 2023-10-06 Fixed in 5.3.22 CWE-22
TI-2023-09211 CVE-2023-23365 · GHSA-95pq-fvwq-w4hv

Path traversal in QNAP Music Station

Priority LOW 35

A path traversal vulnerability has been reported to affect Music Station.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00668 Published 2023-10-06 Fixed in 5.3.22 CWE-22
TI-2018-14140 CVE-2018-19952 · GHSA-6jgx-cv2x-9pwj

Improper input validation in QNAP Music Station

Priority LOW 35

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01267 Published 2020-11-02 Fixed in 5.1.13, 5.2.9 +1 CWE-20
TI-2020-02206 CVE-2020-2494 · GHSA-jx9p-jf7x-8rr2

Cross-site Scripting Vulnerability in Music Station

Priority LOW 29

This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00993 Published 2020-12-10 Fixed in 5.3.13, 5.3.12 CWE-79
TI-2018-14139 CVE-2018-19951 · GHSA-4v82-25rx-c86g

Cross-site scripting in QNAP Music Station

Priority LOW 29

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00765 Published 2020-11-02 Fixed in 5.1.13, 5.2.9 +1 CWE-79
TI-2019-05099 CVE-2019-7185 · GHSA-c4gw-w6f2-29hh

Cross-site scripting in QNAP NAS devices running Music Station

Priority LOW 25

This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01456 Published 2019-12-05 No fix listed CWE-79
Open these records in search →