Search criteria

8 vulnerabilities found for QNAP Media Streaming Add-On by QNAP

CVE-2017-7634 (GCVE-0-2017-7634)

Vulnerability from cvelistv5 – Published: 2018-03-08 14:00 – Updated: 2024-09-16 20:11
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.771Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7634",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7634",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-16T20:11:44.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7638 (GCVE-0-2017-7638)

Vulnerability from cvelistv5 – Published: 2018-03-08 14:00 – Updated: 2024-09-17 02:36
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.
Severity ?
No CVSS data available.
CWE
  • Incorrect Access Control
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7638",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Incorrect Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7638",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T02:36:29.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7640 (GCVE-0-2017-7640)

Vulnerability from cvelistv5 – Published: 2018-03-08 14:00 – Updated: 2024-09-17 01:51
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges.
Severity ?
No CVSS data available.
CWE
  • OS Command Injection
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:28.200Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7640",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7640",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T01:51:04.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7641 (GCVE-0-2017-7641)

Vulnerability from cvelistv5 – Published: 2018-03-08 14:00 – Updated: 2024-09-17 03:23
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections.
Severity ?
No CVSS data available.
CWE
  • Cross-site request forgery
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.704Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7641",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7641",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T03:23:51.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7634 (GCVE-0-2017-7634)

Vulnerability from nvd – Published: 2018-03-08 14:00 – Updated: 2024-09-16 20:11
VLAI?
Summary
Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.
Severity ?
No CVSS data available.
CWE
  • Cross-site scripting
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.771Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7634",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7634",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-16T20:11:44.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7638 (GCVE-0-2017-7638)

Vulnerability from nvd – Published: 2018-03-08 14:00 – Updated: 2024-09-17 02:36
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.
Severity ?
No CVSS data available.
CWE
  • Incorrect Access Control
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7638",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Incorrect Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7638",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T02:36:29.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7640 (GCVE-0-2017-7640)

Vulnerability from nvd – Published: 2018-03-08 14:00 – Updated: 2024-09-17 01:51
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges.
Severity ?
No CVSS data available.
CWE
  • OS Command Injection
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:28.200Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7640",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7640",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T01:51:04.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7641 (GCVE-0-2017-7641)

Vulnerability from nvd – Published: 2018-03-08 14:00 – Updated: 2024-09-17 03:23
VLAI?
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections.
Severity ?
No CVSS data available.
CWE
  • Cross-site request forgery
Assigner
References
Impacted products
Vendor Product Version
QNAP QNAP Media Streaming Add-On Affected: 421.1.0.2, 430.1.2.0, and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.704Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QNAP Media Streaming Add-On",
          "vendor": "QNAP",
          "versions": [
            {
              "status": "affected",
              "version": "421.1.0.2, 430.1.2.0, and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-03-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-08T13:57:01",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2018-03-08T00:00:00",
          "ID": "CVE-2017-7641",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QNAP Media Streaming Add-On",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "421.1.0.2, 430.1.2.0, and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08",
              "refsource": "CONFIRM",
              "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201803-08"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2017-7641",
    "datePublished": "2018-03-08T14:00:00Z",
    "dateReserved": "2017-04-10T00:00:00",
    "dateUpdated": "2024-09-17T03:23:51.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}