CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-21900 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2024-21900
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Se ha informado que una vulnerabilidad de inyección afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados ejecutar comandos a través de una red. El fabricante ha solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.3.2578 build 20231110 y posteriores QuTS hero h5.1.3.2578 build 20231110 y posteriores QuTScloud c5.1.5.2651 y posteriores • https://www.qnap.com/en/security-advisory/qsa-24-09 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2024-21899 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2024-21899
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later Se ha informado que una vulnerabilidad de autenticación incorrecta afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios comprometer la seguridad del sistema a través de una red. El fabricante ha solucionado la vulnerabilidad en las siguientes versiones: QTS 5.1.3.2578 compilación 20231110 y posteriores QTS 4.5.4.2627 compilación 20231225 y posteriores QuTS hero h5.1.3.2578 compilación 20231110 y posteriores QuTS hero h4.5.4.2626 compilación 20231225 y posteriores QuTScloud c5.1.5.2651 y posteriores This vulnerability allows remote attackers to make arbitrary changes to configuration on affected installations of QNAP TS-464 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privWizard API endpoints. • https://www.qnap.com/en/security-advisory/qsa-24-09 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 42EXPL: 0CVE-2023-23367 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-23367
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los administradores autenticados ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2376 build 20230421 y posteriores QuTS hero h5.0.1.2376 build 20230421 y posteriores QuTScloud c5.1.0.2498 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-24 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-39301 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-39301
A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later Se ha informado que una vulnerabilidad de Server-Side Request Forgery (SSRF) afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios autenticados leer datos de aplicaciones a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2514 compilación 20230906 y posteriores QTS 5.1.1.2491 compilación 20230815 y posteriores QuTS hero h5.0.1.2515 compilación 20230907 y posteriores QuTS hero h5.1.1.2488 compilación 20230812 y posteriores QuTScloud c5.1.0.2498 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-51 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 45EXPL: 0CVE-2023-23368 – QTS, QuTS hero, QuTScloud
https://notcve.org/view.php?id=CVE-2023-23368
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Se ha informado que una vulnerabilidad de inyección de comandos del sistema operativo afecta a varias versiones del sistema operativo QNAP. Si se explota, la vulnerabilidad podría permitir a los usuarios ejecutar comandos a través de una red. Ya hemos solucionado la vulnerabilidad en las siguientes versiones: QTS 5.0.1.2376 compilación 20230421 y posteriores QTS 4.5.4.2374 compilación 20230416 y posteriores QuTS hero h5.0.1.2376 compilación 20230421 y posteriores QuTS hero h4.5.4.2374 compilación 20230417 y posteriores QuTScloud c5.0.1.2374 y posteriores • https://www.qnap.com/en/security-advisory/qsa-23-31 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •