Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 656

Export CSV
CVE-2021-34356

Stored XSS Vulnerability in Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Nas Photo Station
CVE-2021-34355

Stored XSS Vulnerability in Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Nas Photo Station
CVE-2021-34354

Stored Cross-site Scripting Vulnerability in Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Nas Photo Station
CVE-2021-34352

Command Injection Vulnerability in QVR

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Qnap
Products
Qvr
CVE-2021-34351

Command Injection Vulnerability in QVR

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Qnap
Products
Qvr
CVE-2021-34349

Command Injection Vulnerability in QVR

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Qnap
Products
Qvr
CVE-2021-34348

Command Injection Vulnerability in QVR

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Qnap
Products
Qvr
CVE-2021-34346

Stack Based Overflow Vulnerability in NVR Storage Expansion

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Qnap
Products
Nvr Storage Expansion Nvr Storage Expansion Firmware
CVE-2021-34345

Stack Based Overflow Vulnerability in NVR Storage Expansion

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Qnap
Products
Ej1600 Ej1600 Firmware Tl-d1600s and 25 more
CVE-2021-34344

Stack Buffer Overflow Vulnerability in QUSBCam2

A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Qnap
Products
Qts Qusbcam2 Quts Hero
CVE-2021-34343

Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later

CVSS 3.1 · 6 Medium EPSS 1.9% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2021-28816

Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud

A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud
CVE-2021-28815

Insecure Storage of Sensitive Information in myQNAPcloud Link

Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.

CVSS 3.1 · 6 Medium EPSS 1.7% KEV · Not listed
Vendors
Qnap
Products
Myqnapcloud Link Qts Quts Hero and 1 more
CVE-2021-28814

Improper Access Control Vulnerability in Helpdesk

An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Qnap
Products
Helpdesk
CVE-2021-28813

Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch

A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later

CVSS 3.1 · 9.6 Critical EPSS 1.1% KEV · Not listed
Vendors
Qnap
Products
Qgd-1600p Qgd-1602p Qgd-3014pt and 3 more
CVE-2021-28812

Command Injection Vulnerability in Video Station

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud and 1 more
CVE-2021-28810

Vulnerability in Roon Server

If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Qnap
Products
Roon Server
CVE-2021-28809

Missing Authentication for Critical Function in RTRR Server in HBS3

An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later

CVSS 3.1 · 9.8 Critical EPSS 16.1% KEV · Not listed
Vendors
Qnap
Products
Hybrid Backup Sync Qts
CVE-2021-28807

Post-Authentication Reflected XSS Vulnerability in Q'center

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later

CVSS 3.1 · 7.7 High EPSS 1.4% KEV · Not listed
Vendors
Qnap
Products
Q\'center Qts Quts Hero and 1 more
CVE-2021-28806

DOM-Based XSS Vulnerability in QTS and QuTS hero

A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Qts Quts Hero Qutscloud