Skip to content
CVE Tracker

QNAP vulnerabilities

36 published CVEs name QNAP among the affected products.

All 36 in the listAtom feed of new CVEs
Published CVEs
36
Last 12 months
0
Critical
15
Known exploited
0

Critical 15High 12Medium 9Low 0Not scored 0

CVEs per yearBy the year they were published

  1. 201718
  2. 201818

Newest CVEs

  • CVE-2018-0722

    Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could…

    QNAP · Photo Station

    High7.5
  • CVE-2018-0724

    Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in…

    QNAP · Q'center Virtual Appliance

    Medium6.1
  • CVE-2018-0723

    Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in…

    QNAP · Q'center Virtual Appliance

    Medium6.1
  • CVE-2018-0716

    Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4…

    QNAP · Qsync Central

    Medium6.1
  • CVE-2018-14749

    Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions…

    QNAP · QNAP QTS

    Critical9.8
  • CVE-2018-14748

    Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier…

    QNAP · QNAP QTS

    High7.5
  • CVE-2018-14747

    NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier…

    QNAP · QNAP QTS

    High7.5
  • CVE-2018-14746

    Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions…

    QNAP · QNAP QTS

    Critical9.8
  • CVE-2018-0718

    Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands…

    QNAP · Music Station

    Critical9.8
  • CVE-2018-0715

    Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised…

    QNAP · Photo Station

    Medium6.1

Products with the most CVEs

  1. Q'center Virtual Appliance7
  2. QNAP Media Streaming Add-On4
  3. QNAP QTS4
  4. Photo Station3
  5. QTS Login function2
  6. QTS Password function2
  7. App Center in QTS1
  8. Helpdesk in QTS1
  9. LDAP Server in QTS1
  10. Music Station1

Most common weaknesses

  1. CWE-119 Memory buffer bounds error8
  2. CWE-79 Cross-site scripting (XSS)8
  3. CWE-77 Command injection5
  4. CWE-78 OS command injection5
  5. CWE-200 Exposure of sensitive information1
  6. CWE-22 Path traversal1
  7. CWE-287 Improper authentication1
  8. CWE-352 Cross-site request forgery (CSRF)1
  9. CWE-426 1
  10. CWE-476 NULL pointer dereference1