CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2023-32970 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-32970
13 Oct 2023 — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. QES is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2453 build 20230708 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later QTS 5.1.0.2... • https://www.qnap.com/en/security-advisory/qsa-23-41 • CWE-476: NULL Pointer Dereference •
CVSS: 8.3EPSS: 0%CPEs: 7EXPL: 0CVE-2023-32972 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-32972
06 Oct 2023 — A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later ... • https://www.qnap.com/en/security-advisory/qsa-23-37 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.3EPSS: 0%CPEs: 7EXPL: 0CVE-2023-32971 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-32971
06 Oct 2023 — A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2424 build 20230609 and later ... • https://www.qnap.com/en/security-advisory/qsa-23-37 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23371 – QVPN Device Client
https://notcve.org/view.php?id=CVE-2023-23371
06 Oct 2023 — A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.2.0.0823 and later Se ha informado que una vulnerabilidad de transmisión de texto plano de información confidencial afecta a QVPN Device Client. Si se explota, la vulnerabilidad podría permiti... • https://www.qnap.com/en/security-advisory/qsa-23-39 • CWE-311: Missing Encryption of Sensitive Data CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23370 – QVPN Device Client
https://notcve.org/view.php?id=CVE-2023-23370
06 Oct 2023 — An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later Se ha informado que una vulnerabilidad de credenciales insuficientemente protegidas afecta a QVPN Device Client. Si se expl... • https://www.qnap.com/en/security-advisory/qsa-23-36 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23366 – Music Station
https://notcve.org/view.php?id=CVE-2023-23366
06 Oct 2023 — A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later Se ha informado que una vulnerabilidad de path traversal afecta a Music Station. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados leer el contenido de archivos inesper... • https://www.qnap.com/en/security-advisory/qsa-23-28 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23365 – Music Station
https://notcve.org/view.php?id=CVE-2023-23365
06 Oct 2023 — A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later Se ha informado que una vulnerabilidad de path traversal afecta a Music Station. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados leer el contenido de archivos inesper... • https://www.qnap.com/en/security-advisory/qsa-23-28 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-23364 – Multimedia Console
https://notcve.org/view.php?id=CVE-2023-23364
22 Sep 2023 — A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later Se ha informado que una copia del búfer sin verificar el tamaño de la vulnerabilidad de entrada afecta los sistemas operativos de QN... • https://www.qnap.com/en/security-advisory/qsa-23-29 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2023-23363 – QTS
https://notcve.org/view.php?id=CVE-2023-23363
22 Sep 2023 — A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later Se ha informado que una copia del búfer sin verificar el tamaño de la vulnerab... • https://www.qnap.com/en/security-advisory/qsa-23-25 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2023-23362 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-23362
22 Sep 2023 — An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Se ha informado que una vulnerabi... • https://www.qnap.com/en/security-advisory/qsa-23-18 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •