CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34977 – Video Station
https://notcve.org/view.php?id=CVE-2023-34977
A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later Se ha informado que una vulnerabilidad de Cross-Site Scripting (XSS) afecta a Video Station. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados inyectar código malicioso a través de una red. Ya se ha solucionado la vulnerabilidad en la siguiente versión: Video Station 5.7.0 (2023/07/27) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-52 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34976 – Video Station
https://notcve.org/view.php?id=CVE-2023-34976
A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later Se ha informado que una vulnerabilidad de inyección SQL afecta a Video Station. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados inyectar código malicioso a través de una red. Ya se ha solucionado la vulnerabilidad en la siguiente versión: Video Station 5.7.0 (2023/07/27) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-52 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34975 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-34975
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud c5.1.x is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h4.5.4.2626 build 20231225 and later QTS 4.5.4.2627 build 20231225 and later Se ha informado que una vulnerabilidad de inyección SQL afecta a Video Station. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados inyectar código malicioso a través de una red. Ya se ha solucionado la vulnerabilidad en la siguiente versión: Video Station 5.7.0 (2023/07/27) y posteriores • https://www.qnap.com/en/security-advisory/qsa-24-12 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32976 – Container Station
https://notcve.org/view.php?id=CVE-2023-32976
An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Container Station 2.6.7.44 and later Se ha informado que una vulnerabilidad de inyección de comandos del Sistema Operativo afecta a Container Station. Si se explota, la vulnerabilidad podría permitir a los administradores autenticados ejecutar comandos a través de una red. Ya se ha solucionado la vulnerabilidad en la siguiente versión: Container Station 2.6.7.44 y posteriores. • https://www.qnap.com/en/security-advisory/qsa-23-44 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32974 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-32974
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTScloud c5.1.0.2498 and later Se ha informado que una vulnerabilidad de path traversal afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios leer el contenido de archivos inesperados y exponer datos confidenciales a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.0.2444 build 20230629 y posteriores QuTS hero h5.1.0.2424 build 20230609 y posteriores QuTScloud c5.1.0.2498 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-42 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •