CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-38687 – Stack Overflow Vulnerability in Surveillance Station
https://notcve.org/view.php?id=CVE-2021-38687
29 Dec 2021 — A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 ... • https://www.qnap.com/en/security-advisory/qsa-21-46 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28797 – Stack Buffer Overflow in Surveillance Station
https://notcve.org/view.php?id=CVE-2021-28797
14 Apr 2021 — A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Se ha reportado una vulnerabilidad de desbordamiento... • https://www.qnap.com/en/security-advisory/qsa-21-07 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 3%CPEs: 3EXPL: 1CVE-2020-2501 – Stack Buffer Overflow in Surveillance Station
https://notcve.org/view.php?id=CVE-2020-2501
17 Feb 2021 — A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Se ha reportado una vulnerabilidad de desbordamiento... • https://github.com/Alonzozzz/alonzzzo • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2013-0142
https://notcve.org/view.php?id=CVE-2013-0142
07 Jun 2013 — QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors. Los dispositivos QNAP VioStor NVR con firmware v4.0.3, y el componente Surveillance Station Pro en QNAP NAS, tiene una cuenta de invitado incluida en el código que permite que atacantes remotos consigan acceso al servidor web mediante vectores no especificados. • http://www.kb.cert.org/vuls/id/927644 • CWE-255: Credentials Management Errors •
CVSS: 8.8EPSS: 9%CPEs: 4EXPL: 1CVE-2013-0143 – QNAP VioStor NVR / QNAP NAS - Remote Code Execution
https://notcve.org/view.php?id=CVE-2013-0143
07 Jun 2013 — cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string. cgi-bin/pingping.cgi en dispositivos QNAP VioStor NVR con firmware v4.0.3, y en el componente Surveillance Station Pro en QNAP NAS, permite que usuarios remotos autenticados ejecuten comandos de su elección haciendo uso de acceso de invit... • https://www.exploit-db.com/exploits/38550 • CWE-94: Improper Control of Generation of Code ('Code Injection') •