DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
QNAP NAS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-01-07
Ein entfernter Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.
01
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-47560US | high8.8 | — | ||
An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We ha… | ||||
| CVE-2023-47559US | medium5.4 | — | ||
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a netwo… | ||||
| CVE-2023-47219US | high8.8 | — | ||
A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.
We have… | ||||
| CVE-2023-45044US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-45043US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-45042US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-45041US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-45040US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-45039US | high7.2 | — | ||
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… | ||||
| CVE-2023-41289US | high8.8 | — | ||
An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We… | ||||
| CVE-2023-41288US | high8.8 | — | ||
An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network.
We have alrea… | ||||
| CVE-2023-41287US | high8.8 | — | ||
A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network.
We have already… | ||||
| CVE-2023-39296US | high7.5 | — | ||
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attri… | ||||
| CVE-2023-39294US | high7.2 | — | ||
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators t… | ||||
| CVE-2022-43634US | critical9.8 | — | ||
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specif… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Proof of Concept (PoC) für CVE-2023-39296external
- WID-SEC-W-2024-0018 - CSAF Versionself
- WID-SEC-2024-0018 - Portal Versionself
- QNAP Security Advisory QSA-23-27 vom 2024-01-07external
- QNAP Security Advisory QSA-23-23 vom 2024-01-07external
- QNAP Security Advisory QSA-23-32 vom 2024-01-07external
- QNAP Security Advisory QSA-23-34 vom 2024-01-07external
- QNAP Security Advisory QSA-23-54 vom 2024-01-07external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan