CVSS: 9.8EPSS: 0%CPEs: 91EXPL: 0CVE-2023-23369 – QTS, Multimedia Console, and Media Streaming add-on
https://notcve.org/view.php?id=CVE-2023-23369
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: Multimedia Console 2.1.2 ( 2023/05/04 ) y posteriores Multimedia Console 1.4.8 ( 2023/05/05 ) y posteriores QTS 5.1.0.2399 build 20230515 y posteriores QTS 4.3.6.2441 build 20230621 y posteriores QTS 4.3.4.2451 build 20230621 y posteriores QTS 4.3.3.2420 build 20230621 y posteriores QTS 4.2.6 build 20230621 y posteriores Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) y posteriores Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-35 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-23364 – Multimedia Console
https://notcve.org/view.php?id=CVE-2023-23364
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later Se ha informado que una copia del búfer sin verificar el tamaño de la vulnerabilidad de entrada afecta los sistemas operativos de QNAP. Si se explota, la vulnerabilidad posiblemente permita a usuarios remotos ejecutar código a través de vectores no especificados. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: Consola Multimedia 2.1.1 (29/03/2023) y posteriores Consola Multimedia 1.4.7 (20/03/2023) y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-29 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-38684 – Buffer Overflow Vulnerability in Multimedia Console
https://notcve.org/view.php?id=CVE-2021-38684
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later Se ha informado de una vulnerabilidad de desbordamiento del búfer de la pila que afecta al NAS de QNAP que ejecuta la consola multimedia. Si se explota, esta vulnerabilidad permite a los atacantes ejecutar código arbitrario. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) y posteriores Multimedia Console 1.5.3 ( 2021/10/05 ) y posteriores • https://www.qnap.com/en/security-advisory/qsa-21-45 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 60EXPL: 0CVE-2020-36195 – SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
https://notcve.org/view.php?id=CVE-2020-36195
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later Se ha reportado de una vulnerabilidad de inyección SQL que afecta al NAS de QNAP que ejecuta Multimedia Console o el add-on Media Streaming. Si se explota, la vulnerabilidad permite a atacantes remotos obtener información de la aplicación. • https://www.qnap.com/en/security-advisory/qsa-21-11 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-943: Improper Neutralization of Special Elements in Data Query Logic •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-2493 – Cross-site Scripting Vulnerability in Multimedia Console
https://notcve.org/view.php?id=CVE-2020-2493
This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later. Esta vulnerabilidad de tipo cross-site scripting en Multimedia Console permite a atacantes remotos inyectar código malicioso. QNAP ya ha corregido esta vulnerabilidad en Multimedia Console versión 1.1.5 y posterior. • https://www.qnap.com/en/security-advisory/qsa-20-14 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •