Vulnerabilities > Qnap
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-12-04 | CVE-2018-0729 | Command Injection vulnerability in Qnap Music Station This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. | 7.5 |
| 2019-12-04 | CVE-2018-0728 | Improper Privilege Management vulnerability in Qnap Helpdesk This improper access control vulnerability in Helpdesk allows attackers to access the system logs. | 5.0 |
| 2019-05-09 | CVE-2019-7181 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Qnap Myqnapcloud 1.3.3.0925 Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program. | 5.0 |
| 2019-02-01 | CVE-2018-0722 | Path Traversal vulnerability in Qnap Photo Station Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device. | 5.0 |
| 2018-12-26 | CVE-2018-0724 | Cross-site Scripting vulnerability in Qnap Q'Center Virtual Appliance Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723. | 4.3 |
| 2018-12-26 | CVE-2018-0723 | Cross-site Scripting vulnerability in Qnap Q'Center Virtual Appliance Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724. | 4.3 |
| 2018-11-30 | CVE-2018-0716 | Cross-site Scripting vulnerability in Qnap QTS Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application. | 4.3 |
| 2018-11-28 | CVE-2018-14749 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Qnap QTS Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS. | 7.5 |
| 2018-11-28 | CVE-2018-14748 | Incorrect Authorization vulnerability in Qnap QTS Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS. | 7.8 |
| 2018-11-28 | CVE-2018-14747 | NULL Pointer Dereference vulnerability in Qnap QTS NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server. | 5.0 |