Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.
Product
QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.
Vulnerabilities 15
-
Critical 9.8CVE-2022-43634 EPSS 19%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authenticat…
-
High 8.8
Video Station
An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/…
-
High 7.5
QTS, QuTS hero
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a ne…
-
High 7.4
QuMagie
An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and l…
-
Medium 6.6
QTS, QuTS hero
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…
-
Medium 6.3
QcalAgent
An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QcalAgent 1.1.8 a…
-
Medium 5.5
QuMagie
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2…
-
Medium 4.3
Video Station
A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.8
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vu…
-
Low 3.5
QuMagie
A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later
Revision history
-
#1
Initiale Fassung
References
-
QNAP Security Advisory QSA-23-22 vom 2024-01-07
https://www.qnap.com/go/security-advisory/qsa-23-22
-
QNAP Security Advisory QSA-23-54 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-54
-
QNAP Security Advisory QSA-23-64 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-64
-
Proof of Concept (PoC) für CVE-2023-39296
https://securityonline.info/decoding-the-cve-2023-39296-vulnerability-a-technical-and-poc-analysis/
-
QNAP Security Advisory QSA-23-55 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-55
-
QNAP Security Advisory QSA-23-34 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-34
-
QNAP Security Advisory QSA-23-32 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-32
-
QNAP Security Advisory QSA-23-23 vom 2024-01-07
https://www.qnap.com/en/security-advisory/qsa-23-23
-
QNAP Security Advisory QSA-23-27 vom 2024-01-07
https://www.qnap.com/de-de/security-advisory/qsa-23-27