CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38674 – Reflected XSS Vulnerability in TFTP
https://notcve.org/view.php?id=CVE-2021-38674
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later Se ha informado de una vulnerabilidad de tipo cross-site scripting (XSS) que afecta a QTS, QuTS hero y QuTScloud. Si es explotado, esta vulnerabilidad permite a atacantes remotos inyectar código malicioso. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de QTS, QuTS hero y QuTScloud: QuTS hero h4.5.4.1771 build 20210825 y posteriores QTS 4.5.4.1787 build 20210910 y posteriores QuTScloud c4.5.7.1864 y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-63 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2021-34343 – Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud
https://notcve.org/view.php?id=CVE-2021-34343
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later Se ha reportado de una vulnerabilidad de desbordamiento del búfer de la pila que afecta al dispositivo QNAP que ejecuta QTS, QuTScloud, QuTS hero. Si es explotado, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 y posteriores QTS 5.0.0.1716 build 20210701 y posteriores QuTScloud c4.5.6.1755 y posteriores QuTS hero h4.5.4.1771 build 20210825 y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-33 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-28816 – Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud
https://notcve.org/view.php?id=CVE-2021-28816
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later Se ha reportado de una vulnerabilidad de desbordamiento del búfer de la pila que afecta al dispositivo QNAP que ejecuta QTS, QuTScloud, QuTS hero. Si es explotado, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 y posteriores QTS 5.0.0.1716 build 20210701 y posteriores QTS 4.3.3.1693 build 20210624 y posteriores QTS 4.3.6.1750 build 20210730 y posteriores QuTScloud c4.5.6.1755 y posteriores QuTS hero h4.5.4.1771 build 20210825 y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-33 • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-19957 – Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud
https://notcve.org/view.php?id=CVE-2018-19957
A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later Se ha reportado de una vulnerabilidad que implica encabezados de seguridad HTTP insuficientes y que afecta a los NAS de QNAP que ejecutan QTS, QuTS hero y QuTScloud. Esta vulnerabilidad permite a atacantes remotos iniciar ataques de privacidad y seguridad. Ya hemos corregido esta vulnerabilidad en las siguientes versiones: QTS 4.5.4.1715 build 20210630 y posteriores QuTS hero h4.5.4.1771 build 20210825 y posteriores QuTScloud c4.5.6.1755 build 20210809 y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-03 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28804 – Command Injection Vulnerabilities in QTS and QuTS hero
https://notcve.org/view.php?id=CVE-2021-28804
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. • https://www.qnap.com/zh-tw/security-advisory/qsa-21-29 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •