CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36196 – Stored XSS Vulnerability in QuLog Center
https://notcve.org/view.php?id=CVE-2020-36196
A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0. Se ha reportado de una vulnerabilidad de tipo XSS almacenado que afecta al NAS de QNAP que ejecuta QuLog Center. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-30 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-36194 – XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero
https://notcve.org/view.php?id=CVE-2020-36194
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-32 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28800 – Command Injection Vulnerability in QTS
https://notcve.org/view.php?id=CVE-2021-28800
A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-28 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-28815 – Insecure Storage of Sensitive Information in myQNAPcloud Link
https://notcve.org/view.php?id=CVE-2021-28815
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4. Se ha reportado de que el almacenamiento no seguro de información confidencial afecta a los NAS de QNAP que ejecutan myQNAPcloud Link. Si es explotado, esta vulnerabilidad permite a atacantes remotos leer información confidencial accediendo al mecanismo de almacenamiento sin restricciones. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-26 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28814 – Improper Access Control Vulnerability in Helpdesk
https://notcve.org/view.php?id=CVE-2021-28814
An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4. Se ha reportado una vulnerabilidad de control de acceso inapropiado que afecta a QNAP NAS. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-25 • CWE-269: Improper Privilege Management •