QNAP QTS 4.3.6

DeadBolt Ransomware

Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

Missing Authentication for Critical Function in RTRR Server in HBS3

Command Injection Vulnerability in QTS and QuTS hero

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On

Stack Buffer Overflow Vulnerability in QUSBCam2

Stack Overflow Vulnerability in Surveillance Station

Improper Access Control Vulnerability in Music Station

Command Injection Vulnerability in Media Streaming Add-on

Post-Authentication Reflected XSS Vulnerability in Q'center

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Cross-site Scripting Vulnerability in Photo Station

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Cross-site Scripting Vulnerability in File Station

A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.