Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2020-AVI-793
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans QNAP QTS et QuTS hero. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Qnap | QuTS hero | QuTS hero versions antérieures à h4.5.1.1472 build 20201031 | ||
| Qnap | QTS | Photo Station pour QTS 4.5.1 et QTS 4.4.3 versions antérieures à 6.0.12 | ||
| Qnap | QTS | QTS versions antérieures à 4.3.6.1333 build 20200608 | ||
| Qnap | QTS | Photo Station pour QTS 4.3.4 versions antérieures à 5.7.13 | ||
| Qnap | QTS | QTS versions antérieures à 4.3.4.1368 build 20200703 | ||
| Qnap | QTS | QTS versions antérieures à 4.3.3.1315 build 20200611 | ||
| Qnap | QTS | Music Station pour QTS 4.5.1 et QTS 4.4.3 versions antérieures à 5.3.12 | ||
| Qnap | QTS | Photo Station pour QTS 4.3.3 versions antérieures à 5.4.10 | ||
| Qnap | QuTS hero | Music Station pour QuTS hero h4.5.1 versions antérieures à 5.3.13 | ||
| Qnap | QTS | Photo Station pour QTS 4.2.6 versions antérieures à 5.2.11 | ||
| Qnap | QTS | QTS versions antérieures à 4.2.6 build 20200611 | ||
| Qnap | QTS | QTS versions antérieures à 4.4.3.1354 build 20200702 | ||
| Qnap | QTS | QTS versions antérieures à 4.5.1.1456 build 20201015 | ||
| Qnap | N/A | Multimedia Console versions antérieures à 1.1.5 | ||
| Qnap | QTS | Photo Station pour QTS 4.3.6 versions antérieures à 5.7.12 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "QuTS hero versions ant\u00e9rieures \u00e0 h4.5.1.1472 build 20201031",
"product": {
"name": "QuTS hero",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Photo Station pour QTS 4.5.1 et QTS 4.4.3 versions ant\u00e9rieures \u00e0 6.0.12",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.3.6.1333 build 20200608",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Photo Station pour QTS 4.3.4 versions ant\u00e9rieures \u00e0 5.7.13",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.3.4.1368 build 20200703",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.3.3.1315 build 20200611",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Music Station pour QTS 4.5.1 et QTS 4.4.3 versions ant\u00e9rieures \u00e0 5.3.12",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Photo Station pour QTS 4.3.3 versions ant\u00e9rieures \u00e0 5.4.10",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Music Station pour QuTS hero h4.5.1 versions ant\u00e9rieures \u00e0 5.3.13",
"product": {
"name": "QuTS hero",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Photo Station pour QTS 4.2.6 versions ant\u00e9rieures \u00e0 5.2.11",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.2.6 build 20200611",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.4.3.1354 build 20200702",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "QTS versions ant\u00e9rieures \u00e0 4.5.1.1456 build 20201015",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Multimedia Console versions ant\u00e9rieures \u00e0 1.1.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Qnap",
"scada": false
}
}
},
{
"description": "Photo Station pour QTS 4.3.6 versions ant\u00e9rieures \u00e0 5.7.12",
"product": {
"name": "QTS",
"vendor": {
"name": "Qnap",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-2497",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2497"
},
{
"name": "CVE-2019-7198",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7198"
},
{
"name": "CVE-2020-2494",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2494"
},
{
"name": "CVE-2020-2496",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2496"
},
{
"name": "CVE-2020-2498",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2498"
},
{
"name": "CVE-2020-2491",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2491"
},
{
"name": "CVE-2020-2493",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2493"
},
{
"name": "CVE-2020-2495",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2495"
}
],
"links": [],
"reference": "CERTFR-2020-AVI-793",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-12-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans QNAP QTS et QuTS\nhero. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire et une injection de code indirecte \u00e0 distance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans QNAP QTS et QuTS hero",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-20-14 du 7 d\u00e9cembre 2020",
"url": "https://www.qnap.com/fr-fr/security-advisory/qsa-20-14"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-20-12 du 7 d\u00e9cembre 2020",
"url": "https://www.qnap.com/fr-fr/security-advisory/qsa-20-12"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-20-15 du 7 d\u00e9cembre 2020",
"url": "https://www.qnap.com/fr-fr/security-advisory/qsa-20-15"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-20-13 du 7 d\u00e9cembre 2020",
"url": "https://www.qnap.com/fr-fr/security-advisory/qsa-20-13"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-20-16 du 7 d\u00e9cembre 2020",
"url": "https://www.qnap.com/fr-fr/security-advisory/qsa-20-16"
}
]
}
CVE-2020-2498 (GCVE-0-2020-2498)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:45 – Updated: 2024-09-16 20:12
VLAI?
EPSS
Title
Cross-site scripting vulnerability in QTS and QuTS hero
Summary
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
< 4.5.1.1456
Affected: < 4.4.3.1354 Affected: < 4.3.6.1333 Affected: < 4.3.4.1368 Affected: < 4.3.3.1315 Affected: < 4.2.6 |
|||||||
|
|||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.418Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 4.5.1.1456"
},
{
"status": "affected",
"version": "\u003c 4.4.3.1354"
},
{
"status": "affected",
"version": "\u003c 4.3.6.1333"
},
{
"status": "affected",
"version": "\u003c 4.3.4.1368"
},
{
"status": "affected",
"version": "\u003c 4.3.3.1315"
},
{
"status": "affected",
"version": "\u003c 4.2.6"
}
]
},
{
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c h4.5.1.1472"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:45:19",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
},
"title": "Cross-site scripting vulnerability in QTS and QuTS hero",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2498",
"STATE": "PUBLIC",
"TITLE": "Cross-site scripting vulnerability in QTS and QuTS hero"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QTS",
"version": {
"version_data": [
{
"version_value": "\u003c 4.5.1.1456"
},
{
"version_value": "\u003c 4.4.3.1354"
},
{
"version_value": "\u003c 4.3.6.1333"
},
{
"version_value": "\u003c 4.3.4.1368"
},
{
"version_value": "\u003c 4.3.3.1315"
},
{
"version_value": "\u003c 4.2.6"
}
]
}
},
{
"product_name": "QuTS hero",
"version": {
"version_data": [
{
"version_value": "\u003c h4.5.1.1472"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-12",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2498",
"datePublished": "2020-12-10T03:45:19.398161Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-16T20:12:28.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2497 (GCVE-0-2020-2497)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:43 – Updated: 2024-09-16 23:27
VLAI?
EPSS
Title
Cross-site scripting vulnerability in QTS and QuTS hero
Summary
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
< 4.5.1.1456
Affected: < 4.4.3.1354 Affected: < 4.3.6.1333 Affected: < 4.3.4.1368 Affected: < 4.3.3.1315 Affected: < 4.2.6 |
|||||||
|
|||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 4.5.1.1456"
},
{
"status": "affected",
"version": "\u003c 4.4.3.1354"
},
{
"status": "affected",
"version": "\u003c 4.3.6.1333"
},
{
"status": "affected",
"version": "\u003c 4.3.4.1368"
},
{
"status": "affected",
"version": "\u003c 4.3.3.1315"
},
{
"status": "affected",
"version": "\u003c 4.2.6"
}
]
},
{
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c h4.5.1.1472"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:43:11",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
},
"title": "Cross-site scripting vulnerability in QTS and QuTS hero",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2497",
"STATE": "PUBLIC",
"TITLE": "Cross-site scripting vulnerability in QTS and QuTS hero"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QTS",
"version": {
"version_data": [
{
"version_value": "\u003c 4.5.1.1456"
},
{
"version_value": "\u003c 4.4.3.1354"
},
{
"version_value": "\u003c 4.3.6.1333"
},
{
"version_value": "\u003c 4.3.4.1368"
},
{
"version_value": "\u003c 4.3.3.1315"
},
{
"version_value": "\u003c 4.2.6"
}
]
}
},
{
"product_name": "QuTS hero",
"version": {
"version_data": [
{
"version_value": "\u003c h4.5.1.1472"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-12",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2497",
"datePublished": "2020-12-10T03:43:11.879997Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-16T23:27:03.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2495 (GCVE-0-2020-2495)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:39 – Updated: 2024-09-16 23:26
VLAI?
EPSS
Title
Cross-site scripting vulnerability in QTS and QuTS hero
Summary
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
< 4.5.1.1456
Affected: < 4.4.3.1354 Affected: < 4.3.6.1333 Affected: < 4.3.4.1368 Affected: < 4.3.3.1315 Affected: < 4.2.6 |
|||||||
|
|||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.629Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 4.5.1.1456"
},
{
"status": "affected",
"version": "\u003c 4.4.3.1354"
},
{
"status": "affected",
"version": "\u003c 4.3.6.1333"
},
{
"status": "affected",
"version": "\u003c 4.3.4.1368"
},
{
"status": "affected",
"version": "\u003c 4.3.3.1315"
},
{
"status": "affected",
"version": "\u003c 4.2.6"
}
]
},
{
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c h4.5.1.1472"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:39:04",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
},
"title": "Cross-site scripting vulnerability in QTS and QuTS hero",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2495",
"STATE": "PUBLIC",
"TITLE": "Cross-site scripting vulnerability in QTS and QuTS hero"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QTS",
"version": {
"version_data": [
{
"version_value": "\u003c 4.5.1.1456"
},
{
"version_value": "\u003c 4.4.3.1354"
},
{
"version_value": "\u003c 4.3.6.1333"
},
{
"version_value": "\u003c 4.3.4.1368"
},
{
"version_value": "\u003c 4.3.3.1315"
},
{
"version_value": "\u003c 4.2.6"
}
]
}
},
{
"product_name": "QuTS hero",
"version": {
"version_data": [
{
"version_value": "\u003c h4.5.1.1472"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-12",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2495",
"datePublished": "2020-12-10T03:39:04.077379Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-16T23:26:14.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2493 (GCVE-0-2020-2493)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:35 – Updated: 2024-09-16 19:24
VLAI?
EPSS
Title
Cross-site Scripting Vulnerability in Multimedia Console
Summary
This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| QNAP Systems Inc. | Multimedia Console |
Affected:
< 1.1.5
|
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.390Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Multimedia Console",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.5"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:35:07",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-14"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in Multimedia Console 1.1.5 and later."
}
],
"source": {
"advisory": "QSA-20-14",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting Vulnerability in Multimedia Console",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2493",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting Vulnerability in Multimedia Console"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Multimedia Console",
"version": {
"version_data": [
{
"version_value": "\u003c 1.1.5"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-14",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-14"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in Multimedia Console 1.1.5 and later."
}
],
"source": {
"advisory": "QSA-20-14",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2493",
"datePublished": "2020-12-10T03:35:07.251969Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-16T19:24:39.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2494 (GCVE-0-2020-2494)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:36 – Updated: 2024-09-17 00:40
VLAI?
EPSS
Title
Cross-site Scripting Vulnerability in Music Station
Summary
This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| QNAP Systems Inc. | Music Station |
Affected:
< 5.3.13
Affected: < 5.3.12 |
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.345Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Music Station",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 5.3.13"
},
{
"status": "affected",
"version": "\u003c 5.3.12"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:36:27",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-13"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions of Music Station.\n\nQuTS hero h4.5.1: Music Station 5.3.13 and later\nQTS 4.5.1: Music Station 5.3.12 and later\nQTS 4.4.3: Music Station 5.3.12 and later"
}
],
"source": {
"advisory": "QSA-20-13",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting Vulnerability in Music Station",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2494",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting Vulnerability in Music Station"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Music Station",
"version": {
"version_data": [
{
"version_value": "\u003c 5.3.13"
},
{
"version_value": "\u003c 5.3.12"
},
{
"version_value": "\u003c 5.3.12"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-13",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-13"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions of Music Station.\n\nQuTS hero h4.5.1: Music Station 5.3.13 and later\nQTS 4.5.1: Music Station 5.3.12 and later\nQTS 4.4.3: Music Station 5.3.12 and later"
}
],
"source": {
"advisory": "QSA-20-13",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2494",
"datePublished": "2020-12-10T03:36:27.203516Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-17T00:40:59.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2496 (GCVE-0-2020-2496)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:41 – Updated: 2024-09-17 02:20
VLAI?
EPSS
Title
Cross-site scripting vulnerability in QTS and QuTS hero
Summary
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
< 4.5.1.1456
Affected: < 4.4.3.1354 Affected: < 4.3.6.1333 Affected: < 4.3.4.1368 Affected: < 4.3.3.1315 Affected: < 4.2.6 |
|||||||
|
|||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.158Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 4.5.1.1456"
},
{
"status": "affected",
"version": "\u003c 4.4.3.1354"
},
{
"status": "affected",
"version": "\u003c 4.3.6.1333"
},
{
"status": "affected",
"version": "\u003c 4.3.4.1368"
},
{
"status": "affected",
"version": "\u003c 4.3.3.1315"
},
{
"status": "affected",
"version": "\u003c 4.2.6"
}
]
},
{
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c h4.5.1.1472"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:41:39",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
},
"title": "Cross-site scripting vulnerability in QTS and QuTS hero",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2496",
"STATE": "PUBLIC",
"TITLE": "Cross-site scripting vulnerability in QTS and QuTS hero"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QTS",
"version": {
"version_data": [
{
"version_value": "\u003c 4.5.1.1456"
},
{
"version_value": "\u003c 4.4.3.1354"
},
{
"version_value": "\u003c 4.3.6.1333"
},
{
"version_value": "\u003c 4.3.4.1368"
},
{
"version_value": "\u003c 4.3.3.1315"
},
{
"version_value": "\u003c 4.2.6"
}
]
}
},
{
"product_name": "QuTS hero",
"version": {
"version_data": [
{
"version_value": "\u003c h4.5.1.1472"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-12",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-12"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later\nQTS 4.3.6.1333 build 20200608 and later\nQTS 4.3.4.1368 build 20200703 and later\nQTS 4.3.3.1315 build 20200611 and later\nQTS 4.2.6 build 20200611 and later"
}
],
"source": {
"advisory": "QSA-20-12",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2496",
"datePublished": "2020-12-10T03:41:39.475091Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-17T02:20:35.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-7198 (GCVE-0-2019-7198)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:34 – Updated: 2024-09-16 21:07
VLAI?
EPSS
Title
Command Injection Vulnerability in QTS and QuTS hero
Summary
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
< 4.5.1.1456
Affected: < 4.4.3.1354 |
|||||||
|
|||||||||
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:38:33.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 4.5.1.1456"
},
{
"status": "affected",
"version": "\u003c 4.4.3.1354"
}
]
},
{
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c h4.5.1.1472"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:34:17",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-16"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later"
}
],
"source": {
"advisory": "QSA-20-16",
"discovery": "EXTERNAL"
},
"title": "Command Injection Vulnerability in QTS and QuTS hero",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2019-7198",
"STATE": "PUBLIC",
"TITLE": "Command Injection Vulnerability in QTS and QuTS hero"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "QTS",
"version": {
"version_data": [
{
"version_value": "\u003c 4.5.1.1456"
},
{
"version_value": "\u003c 4.4.3.1354"
}
]
}
},
{
"product_name": "QuTS hero",
"version": {
"version_data": [
{
"version_value": "\u003c h4.5.1.1472"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-16",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-16"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1472 build 20201031 and later\nQTS 4.5.1.1456 build 20201015 and later\nQTS 4.4.3.1354 build 20200702 and later"
}
],
"source": {
"advisory": "QSA-20-16",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2019-7198",
"datePublished": "2020-12-10T03:34:17.478405Z",
"dateReserved": "2019-01-29T00:00:00",
"dateUpdated": "2024-09-16T21:07:42.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-2491 (GCVE-0-2020-2491)
Vulnerability from cvelistv5 – Published: 2020-12-10 03:34 – Updated: 2024-09-17 00:56
VLAI?
EPSS
Title
Cross-site Scripting Vulnerability in Photo Station
Summary
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later
Severity ?
No CVSS data available.
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| QNAP Systems Inc. | Photo Station |
Affected:
< 6.0.12
Affected: < 5.7.12 Affected: < 5.7.13 Affected: < 5.4.10 Affected: < 5.2.11 |
Credits
Jan Hoff
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:09:54.492Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Photo Station",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0.12"
},
{
"status": "affected",
"version": "\u003c 5.7.12"
},
{
"status": "affected",
"version": "\u003c 5.7.13"
},
{
"status": "affected",
"version": "\u003c 5.4.10"
},
{
"status": "affected",
"version": "\u003c 5.2.11"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jan Hoff"
}
],
"datePublic": "2020-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-10T03:34:06",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-20-15"
}
],
"solutions": [
{
"lang": "en",
"value": "QNAP We have already fixed this vulnerability in the following versions of Photo Station.\n\nQTS 4.5.1: Photo Station 6.0.12 and later\nQTS 4.4.3: Photo Station 6.0.12 and later\nQTS 4.3.6: Photo Station 5.7.12 and later\nQTS 4.3.4: Photo Station 5.7.13 and later\nQTS 4.3.3: Photo Station 5.4.10 and later\nQTS 4.2.6: Photo Station 5.2.11 and later"
}
],
"source": {
"advisory": "QSA-20-15",
"discovery": "EXTERNAL"
},
"title": "Cross-site Scripting Vulnerability in Photo Station",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@qnap.com",
"DATE_PUBLIC": "2020-12-07T00:29:00.000Z",
"ID": "CVE-2020-2491",
"STATE": "PUBLIC",
"TITLE": "Cross-site Scripting Vulnerability in Photo Station"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Photo Station",
"version": {
"version_data": [
{
"version_value": "\u003c 6.0.12"
},
{
"version_value": "\u003c 6.0.12"
},
{
"version_value": "\u003c 5.7.12"
},
{
"version_value": "\u003c 5.7.13"
},
{
"version_value": "\u003c 5.4.10"
},
{
"version_value": "\u003c 5.2.11"
}
]
}
}
]
},
"vendor_name": "QNAP Systems Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Jan Hoff"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.qnap.com/en/security-advisory/qsa-20-15",
"refsource": "CONFIRM",
"url": "https://www.qnap.com/en/security-advisory/qsa-20-15"
}
]
},
"solution": [
{
"lang": "en",
"value": "QNAP We have already fixed this vulnerability in the following versions of Photo Station.\n\nQTS 4.5.1: Photo Station 6.0.12 and later\nQTS 4.4.3: Photo Station 6.0.12 and later\nQTS 4.3.6: Photo Station 5.7.12 and later\nQTS 4.3.4: Photo Station 5.7.13 and later\nQTS 4.3.3: Photo Station 5.4.10 and later\nQTS 4.2.6: Photo Station 5.2.11 and later"
}
],
"source": {
"advisory": "QSA-20-15",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2020-2491",
"datePublished": "2020-12-10T03:34:06.628916Z",
"dateReserved": "2019-12-09T00:00:00",
"dateUpdated": "2024-09-17T00:56:10.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…