CVSS: 8.0EPSS: 0%CPEs: 16EXPL: 0CVE-2018-19943 – QNAP NAS File Station Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-19943
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later Si es explotada esta vulnerabilidad de tipo cross-site scripting podría permitir a atacantes remotos inyectar código malicioso. QNAP ya ha corregido estos problemas en las siguientes versiones de QTS. QTS versión 4.4.2.1270 build 20200410 y posterior a QTS versión 4.4.1.1261 build 20200330 y posterior a QTS versión 4.3.6.1263 build 20200330 y posterior a QTS versión 4.3.4.1282 build 20200408 y posterior a QTS versión 4.3.3.1252 build 20200409 y posterior a QTS versión 4.2.6 build 20200421 y posterior A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. • https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2018-19949 – QNAP NAS File Station Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-19949
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. Si es explotada, esta vulnerabilidad de inyección de comandos podría permitir a atacantes remotos ejecutar comandos arbitrarios. QNAP ya ha corregido el problema en las siguientes versiones de QTS. • https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0CVE-2018-19953 – QNAP NAS File Station Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2018-19953
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. Si es explotada, esta vulnerabilidad de tipo cross-site scripting podría permitir a atacantes remotos inyectar código malicioso. QNAP ya ha corregido el problema en las siguientes versiones de QTS. • https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 4.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-7185
https://notcve.org/view.php?id=CVE-2019-7185
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions. Esta vulnerabilidad de secuencias de comandos entre sitios (XSS) en Music Station permite a los atacantes remotos inyectar y ejecutar secuencias de comandos en la consola de administración del administrador. Para corregir esta vulnerabilidad, QNAP recomienda actualizar Music Station a sus últimas versiones. • https://www.qnap.com/zh-tw/security-advisory/nas-201911-27 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-7184
https://notcve.org/view.php?id=CVE-2019-7184
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions. Esta vulnerabilidad de secuencias de comandos entre sitios (XSS) en Video Station permite a los atacantes remotos inyectar y ejecutar secuencias de comandos en la consola de administración del administrador. Para corregir esta vulnerabilidad, QNAP recomienda actualizar Video Station a sus últimas versiones. • https://www.qnap.com/zh-tw/security-advisory/nas-201911-27 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •