Advisories · Technology

QNAP Systems Inc. QTS.

Every CVE that names QNAP Systems Inc. QTS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-41275 CVE record

CVSS 5.5 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 2 Feb 2024
CVE-2023-41274 CVE record

CVSS 5.5 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 2 Feb 2024
CVE-2023-41273 CVE record

CVSS 5.5 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 2 Feb 2024
CVE-2023-39303 CVE record

CVSS 5.3 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Authentication bypass
Not analysed yet 2 Feb 2024
CVE-2023-39297 CVE record

CVSS 8.8 High

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 2 Feb 2024
CVE-2023-39302 CVE record

CVSS 6.6 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 2 Feb 2024
CVE-2023-32967 CVE record

CVSS 5.0 Medium

QTS, QuTScloud
- QNAP Systems Inc. QuTScloud
- QNAP Systems Inc. QTS
- Broken access control
Not analysed yet 2 Feb 2024
CVE-2023-39294 CVE record

CVSS 6.6 Medium

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 5 Jan 2024
CVE-2023-39296 CVE record

CVSS 7.5 High

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Prototype pollution
Not analysed yet 5 Jan 2024
CVE-2023-45044 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-45043 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-45042 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-45041 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-45040 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-45039 CVE record

CVSS 3.8 Low

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 5 Jan 2024
CVE-2023-32968 CVE record

CVSS 4.5 Medium

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 8 Dec 2023
CVE-2023-23372 CVE record

CVSS 6.5 Medium

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Cross-site scripting (XSS)
Not analysed yet 8 Dec 2023
CVE-2023-32975 CVE record

CVSS 4.9 Medium

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 8 Dec 2023
CVE-2023-23367 CVE record

CVSS 4.7 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 10 Nov 2023
CVE-2023-39301 CVE record

CVSS 4.3 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Server-side request forgery (SSRF)
Not analysed yet 3 Nov 2023
CVE-2023-23369 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

QTS, Multimedia Console, and Media Streaming add-on
- QNAP Systems Inc. Multimedia Console
- QNAP Systems Inc. QTS
- Command injection
Not analysed yet 3 Nov 2023
CVE-2023-23368 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 3 Nov 2023
CVE-2023-34975 CVE record

CVSS 6.6 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Command injection
Not analysed yet 13 Oct 2023
CVE-2023-32974 CVE record

CVSS 7.5 High

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Path traversal
Not analysed yet 13 Oct 2023
CVE-2023-32973 CVE record

CVSS 3.8 Low

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 13 Oct 2023
CVE-2023-32970 CVE record

CVSS 4.9 Medium

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QuTScloud
- Memory corruption
Not analysed yet 13 Oct 2023
CVE-2023-32972 CVE record

CVSS 3.8 Low

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 6 Oct 2023
CVE-2023-32971 CVE record

CVSS 3.8 Low

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 6 Oct 2023
CVE-2023-23363 CVE record

CVSS 8.1 High

QTS
- QNAP Systems Inc. QTS
- Memory corruption
Not analysed yet 22 Sept 2023
CVE-2023-23362 CVE record

CVSS 8.8 High

QTS, QuTS hero, QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 22 Sept 2023
CVE-2023-34973 CVE record

CVSS 3.1 Low

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- CWE-331
Not analysed yet 24 Aug 2023
CVE-2023-34972 CVE record

CVSS 3.5 Low

QTS, QuTS hero and QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Weak cryptography or TLS
Not analysed yet 24 Aug 2023
CVE-2023-34971 CVE record

CVSS 7.1 High

QTS, QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Weak cryptography or TLS
Not analysed yet 24 Aug 2023
CVE-2023-23355 CVE record

CVSS 6.6 Medium

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 29 Mar 2023
CVE-2022-27598 CVE record

CVSS 2.7 Low

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
Not analysed yet 29 Mar 2023
CVE-2022-27597 CVE record

CVSS 2.7 Low

QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Memory corruption
- CWE-489
Not analysed yet 29 Mar 2023
CVE-2022-27596 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Vulnerability in QTS
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- SQL injection
Not analysed yet 30 Jan 2023
CVE-2021-44054 CVE record

CVSS 4.3 Medium

Open redirect
- QNAP Systems Inc. QuTScloud
- QNAP Systems Inc. QuTS hero
- Open redirect
Not analysed yet 5 May 2022
CVE-2021-44053 CVE record

CVSS 5.7 Medium

Reflected XSS
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Cross-site scripting (XSS)
Not analysed yet 5 May 2022
CVE-2021-44052 CVE record

CVSS 6.5 Medium

Arbitrary file read
- QNAP Systems Inc. QuTScloud
- QNAP Systems Inc. QuTS hero
- Path traversal
Not analysed yet 5 May 2022
CVE-2021-44051 CVE record

CVSS 8.8 High

Command injection
- QNAP Systems Inc. QuTScloud
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 5 May 2022
CVE-2021-38693 CVE record

CVSS 5.3 Medium

Path Traversal in thttpd
- QNAP Systems Inc. QuTScloud
- QNAP Systems Inc. QuTS hero
- Path traversal
Not analysed yet 5 May 2022
CVE-2021-38674 CVE record

CVSS 4.2 Medium

Reflected XSS Vulnerability in TFTP
- QNAP Systems Inc. QuTS hero
- QNAP Systems Inc. QTS
- Cross-site scripting (XSS)
Not analysed yet 7 Jan 2022
CVE-2021-34343 CVE record

CVSS 6.0 Medium

Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTScloud
- Memory corruption
Not analysed yet 10 Sept 2021
CVE-2021-28816 CVE record

CVSS 7.6 High

Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTScloud
- Memory corruption
Not analysed yet 10 Sept 2021
CVE-2018-19957 CVE record

Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- CWE-1021
Not analysed yet 10 Sept 2021
CVE-2021-28804 CVE record

Command Injection Vulnerabilities in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 1 Jul 2021
CVE-2021-28802 CVE record

Command Injection Vulnerabilities in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 1 Jul 2021
CVE-2020-36194 CVE record

CVSS 6.1 Medium

XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Cross-site scripting (XSS)
Not analysed yet 1 Jul 2021
CVE-2021-28800 CVE record

CVSS 8.1 High

Command Injection Vulnerability in QTS
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 24 Jun 2021
CVE-2021-28806 CVE record

CVSS 5.7 Medium

DOM-Based XSS Vulnerability in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Cross-site scripting (XSS)
Not analysed yet 3 Jun 2021
CVE-2021-28798 CVE record

CVSS 8.8 High

Relative Path Traversal Vulnerability in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Path traversal
- Broken access control
Not analysed yet 21 May 2021
CVE-2020-36195 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
- QNAP Systems Inc. QTS
- QNAP Systems Inc. Media Streaming add-on
- SQL injection
- Other injection
Not analysed yet 17 Apr 2021
CVE-2020-2509 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Command Injection Vulnerability in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 17 Apr 2021
CVE-2018-19942 CVE record

Cross-site Scripting Vulnerability in File Station
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Cross-site scripting (XSS)
Not analysed yet 16 Apr 2021
CVE-2020-2508 CVE record

CVSS 7.2 High

Command Injection Vulnerability in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 11 Jan 2021
CVE-2018-19945 CVE record

Improper Limitation of a Pathname to a Restricted Directory in QTS
- QNAP Systems Inc. QTS
- Path traversal
- Broken access control
Not analysed yet 31 Dec 2020
CVE-2018-19944 CVE record

Cleartext Transmission of Sensitive Information in SNMP
- QNAP Systems Inc. QTS
- Weak cryptography or TLS
Not analysed yet 31 Dec 2020
CVE-2018-19941 CVE record

Cleartext Storage of Sensitive Information in Cookies
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- CWE-315
Not analysed yet 31 Dec 2020
CVE-2020-25847 CVE record

CVSS 8.8 High

Command Injection Vulnerability in QTS and QuTS hero
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- Command injection
Not analysed yet 29 Dec 2020