CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-38687 – Stack Overflow Vulnerability in Surveillance Station
https://notcve.org/view.php?id=CVE-2021-38687
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later Se ha informado de una vulnerabilidad de desbordamiento del búfer de la pila que afecta al NAS de QNAP que ejecuta Surveillance Station. Si es explotado, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. Ya hemos solucionado esta vulnerabilidad en las siguientes versiones de Surveillance Station: QTS versiones 5.0.0 (64 bits): Surveillance Station versiones 5.2.0.4.2 (26/10/2021) y posteriores QTS versiones 5.0.0 (32 bits): Surveillance Station versiones 5.2.0.3.2 (26/10/2021) y posteriores QTS versiones 4.3.6 (64 bits): Surveillance Station versiones 5.1.5.4.6 (26/10/2021) y posteriores QTS versiones 4.3.6 (32 bits): Surveillance Station versiones 5.1.5.3.6 (26/10/2021) y posteriores QTS versiones 4.3.3: Surveillance Station versiones 5.1.5.3.6 (26/10/2021) y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-46 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28797 – Stack Buffer Overflow in Surveillance Station
https://notcve.org/view.php?id=CVE-2021-28797
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Se ha reportado una vulnerabilidad de desbordamiento del búfer en la región stack de la memoria que afecta a los dispositivos QNAP NAS que ejecutan Surveillance Station. Si es explotada, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones: Surveillance Station versiones 5.1.5.4.3 (y posteriores) para ARM CPU NAS (Sistema Operativo de 64 bits) y x86 CPU NAS (Sistema Operativo de 64 bits) Surveillance Station versiones 5.1.5.3.3 (y posteriores) para ARM CPU NAS (Sistema Operativo de 32 bits) y CPU NAS x86 (Sistema Operativo de 32 bits) • https://www.qnap.com/en/security-advisory/qsa-21-07 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-2501 – Stack Buffer Overflow in Surveillance Station
https://notcve.org/view.php?id=CVE-2020-2501
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Se ha reportado una vulnerabilidad de desbordamiento del búfer en la región stack de la memoria que afecta a los dispositivos NAS de QNAP que ejecutan Surveillance Station. Si es explotada, esta vulnerabilidad permite a atacantes ejecutar código arbitrario. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones: Surveillance Station versiones 5.1.5.4.3 (y posterior) para ARM CPU NAS (SO de 64 bits) y x86 CPU NAS (SO de 64 bits) Surveillance Station versiones 5.1.5.3.3 (y posterior) para ARM CPU NAS (sistema operativo de 32 bits) y CPU NAS x86 (sistema operativo de 32 bits) • https://www.qnap.com/en/security-advisory/qsa-21-07 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16770
https://notcve.org/view.php?id=CVE-2017-16770
File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter. Vulnerabilidad de exposición de información de archivos y directorios en SYNO.SurveillanceStation.PersonalSettings.Photo en Synology Surveillance Station, en versiones anteriores a la 8.1.2-5469, permite que usuarios autenticados remotos obtengan los archivos sensibles de otros usuarios mediante el parámetro filename. • https://www.synology.com/en-global/support/security/Synology_SA_17_77 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16767
https://notcve.org/view.php?id=CVE-2017-16767
Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to inject arbitrary web script or HTML via the userDesc parameter. Vulnerabilidad de Cross-Site Scripting (XSS) en User Profile en Synology Surveillance Station en versiones anteriores a la 8.1.2-5469 permite que atacantes remotos autenticados inyecten scripts web o HTML arbitrarios mediante el parámetro userDesc. • https://www.synology.com/en-global/support/security/Synology_SA_17_77 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •