CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2023-32971 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-32971
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later Se ha informado que una copia del búfer sin verificar el tamaño de la vulnerabilidad de entrada afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los administradores autenticados ejecutar código a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2425 compilación 20230609 y posteriores QTS 5.1.0.2444 compilación 20230629 y posteriores QTS 4.5.4.2467 compilación 20230718 y posteriores QuTS hero h5.0.1.2515 compilación 20230907 y posteriores QuTS hero h5. 1.0.2424 compilación 20230609 y posteriores QuTS hero h4.5.4.2476 compilación 20230728 y posteriores QuTScloud c5.1.0.2498 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-37 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34973 – QTS, QuTS hero
https://notcve.org/view.php?id=CVE-2023-34973
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later • https://www.qnap.com/en/security-advisory/qsa-23-59 • CWE-331: Insufficient Entropy •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34972 – QTS, QuTS hero and QuTScloud
https://notcve.org/view.php?id=CVE-2023-34972
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later • https://www.qnap.com/en/security-advisory/qsa-23-58 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-34971 – QTS, QuTS hero
https://notcve.org/view.php?id=CVE-2023-34971
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later • https://www.qnap.com/en/security-advisory/qsa-23-60 • CWE-326: Inadequate Encryption Strength •