QNAP QTS any version

Cross-site scripting vulnerability in QTS and QuTS hero

Cross-site scripting vulnerability in QTS and QuTS hero

Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cross-site scripting vulnerability in QTS and QuTS hero

Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.

Reflected XSS

Cross-site Scripting Vulnerability in File Station

Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud

Reflected XSS Vulnerability in Proxy Server

Reflected XSS Vulnerability in TFTP

Cross-site scripting vulnerability in QTS and QuTS hero

Open redirect

XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero

QTS, QuTS hero, QuTScloud

DOM-Based XSS Vulnerability in QTS and QuTS hero

Path Traversal in thttpd

QTS, QuTS hero

QuLog Center

QTS, QuTS hero, QuTScloud

Network & Virtual Switch

This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions.

This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions.

myQNAPcloud

QTS, QuTS hero, QuTScloud

QTS, QuTS hero

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)