CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-39301 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-39301
A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later Se ha informado que una vulnerabilidad de Server-Side Request Forgery (SSRF) afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados leer datos de aplicaciones a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2514 compilación 20230906 y posteriores QTS 5.1.1.2491 compilación 20230815 y posteriores QuTS hero h5.0.1.2515 compilación 20230907 y posteriores QuTS hero h5.1.1.2488 compilación 20230812 y posteriores QuTScloud c5.1.0.2498 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-51 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-39299 – Music Station
https://notcve.org/view.php?id=CVE-2023-39299
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later Se ha informado que una vulnerabilidad de path traversal que afecta a Music Station. Si se explota, la vulnerabilidad podría permitir a los usuarios leer el contenido de archivos inesperados y exponer datos confidenciales a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: Music Station 4.8.11 y posteriores Music Station 5.1.16 y posteriores Music Station 5.3.23 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-61 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 91EXPL: 0CVE-2023-23369 – QTS, Multimedia Console, and Media Streaming add-on
https://notcve.org/view.php?id=CVE-2023-23369
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: Multimedia Console 2.1.2 ( 2023/05/04 ) y posteriores Multimedia Console 1.4.8 ( 2023/05/05 ) y posteriores QTS 5.1.0.2399 build 20230515 y posteriores QTS 4.3.6.2441 build 20230621 y posteriores QTS 4.3.4.2451 build 20230621 y posteriores QTS 4.3.3.2420 build 20230621 y posteriores QTS 4.2.6 build 20230621 y posteriores Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) y posteriores Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-35 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 45EXPL: 0CVE-2023-23368 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-23368
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2376 compilación 20230421 y posteriores QTS 4.5.4.2374 compilación 20230416 y posteriores QuTS hero h5.0.1.2376 compilación 20230421 y posteriores QuTS hero h4.5.4.2374 compilación 20230417 y posteriores QuTScloud c5.0.1.2374 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-31 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23373 – QUSBCam2
https://notcve.org/view.php?id=CVE-2023-23373
An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a QUSBCam2. Si se explota, la vulnerabilidad podría permitir a los usuarios ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en la siguiente versión: QUSBCam2 2.0.3 (2023/06/15) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-43 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •