CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-23362 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-23362
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Se ha informado que una vulnerabilidad de inyección de comandos del Sistema Operativo afecta a los sistemas operativos de QNAP. Si se explota, la vulnerabilidad permite a usuarios remotos autenticados ejecutar comandos a través de dispositivos QNAP susceptibles. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2376 compilación 20230421 y posteriores QTS 4.5.4.2374 compilación 20230416 y posteriores QuTS hero h5.0.1.2376 compilación 20230421 y posteriores QuTS hero h4.5.4.2374 compilación 20230417 y posteriores QuTScloud c5.0.1.2374 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-18 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27599 – QVR Pro Client
https://notcve.org/view.php?id=CVE-2022-27599
An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors. We have already fixed the vulnerability in the following version: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later Se ha informado que una inserción de información confidencial en la vulnerabilidad del archivo de Log afecta al producto. Si se explota, la vulnerabilidad posiblemente proporcione a los administradores locales autenticados una ruta adicional menos protegida para adquirir la información a través de vectores no especificados. Ya se ha corregido la vulnerabilidad en las siguientes versiones: Windows 10 SP1, Windows 11, Mac OS y Mac M1: QVR Pro Client 2.3.0.0420 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-08 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34973 – QTS, QuTS hero
https://notcve.org/view.php?id=CVE-2023-34973
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later • https://www.qnap.com/en/security-advisory/qsa-23-59 • CWE-331: Insufficient Entropy •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-34972 – QTS, QuTS hero and QuTScloud
https://notcve.org/view.php?id=CVE-2023-34972
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later • https://www.qnap.com/en/security-advisory/qsa-23-58 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-34971 – QTS, QuTS hero
https://notcve.org/view.php?id=CVE-2023-34971
An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later • https://www.qnap.com/en/security-advisory/qsa-23-60 • CWE-326: Inadequate Encryption Strength •