QNAP QTS any version

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections.

QTS, QuTS hero

QTS, QuTS hero, QuTScloud

QTS, QuTS hero, QuTScloud

QTS, QuTS hero

QTS, QuTS hero

QTS, QuTS hero

QTS, QuTS hero

QTS, QuTS hero, QuTScloud

QTS, QuTS hero, QuTScloud

Arbitrary file read

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter.

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.

QTS, QuTS hero, QuTScloud

This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions.

QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.

Cleartext Transmission of Sensitive Information in SNMP

Cleartext Storage of Sensitive Information in Cookies

QTS, QuTS hero, QuTScloud

QTS, QuTS hero, QuTScloud

QTS, QuTS hero

If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.

Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud

Command Injection Vulnerability in QTS and QuTS hero

If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR

QTS, QuTS hero

QTS, QuTS hero, QuTScloud

QTS, QuTS hero, QuTScloud

QTS, QuTS hero, QuTScloud

QTS, QuTS hero

QTS, QuTS hero

QTS, QuTS hero

Stored XSS Vulnerability in Proxy Server

QTS, QuTS hero, QuTScloud

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.

QTS, QuTS hero

QTS, QuTS hero and QuTScloud

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.