Thomas Fady

An exposure of sensitive information issue has been reported, potentially allowing remote attackers to compromise the system's security.

Name of the Vulnerable Software and Affected Versions: Notes Station 3 versions prior to 3.9.7 Description: The issue is related to insufficient validation of incoming requests, which could allow a remote attacker to gain unauthorized access to protected information by spoofing requests on behalf of the server. This is a server-side request forgery (SSRF) vulnerability. If exploited, it could allow remote authenticated attackers to read application data. Recommendations: For Notes Station 3 versions prior to 3.9.7, update to version 3.9.7 or later to address the issue. As a temporary workaround, consider restricting access to the vulnerable Notes Station application until a patch is applied.

An OS command injection issue has been reported, which could allow remote authenticated attackers to execute commands if exploited.

A missing authentication for critical function issue has been reported, which could allow remote attackers to gain access to and execute certain functions if exploited.

An OS command injection issue has been reported to affect several QNAP operating system versions. If exploited, the issue could allow authenticated administrators to execute commands via a network.

An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network.

An incorrect permission assignment for critical resource vulnerability has been reported. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource.

An improper authentication issue affects QNAP devices running Video Station, allowing attackers to compromise system security by exploiting the vulnerability. This issue is related to deficiencies in the authentication procedure, which can be exploited by a remote attacker to elevate their privileges.

An improper authentication issue affects QNAP devices running Photo Station, allowing attackers to bypass security restrictions and compromise the system's security.

The issue is related to insufficient authorization procedures in the Video Station application, allowing remote attackers to elevate their privileges and access data or perform actions they should not be allowed to. This can lead to unauthorized access and potential data breaches.

The issue is related to improper neutralization of special elements used in an SQL command, also known as SQL Injection, in the Security Management functionality. This allows remote attackers to inject SQL commands via unspecified vectors.

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Helpdesk versions prior to 3.0.4 Description: An improper access control issue has been reported, affecting QNAP NAS. This issue allows remote attackers to compromise the security of the software. Recommendations: For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Helpdesk module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTS hero h4.5.2 QNAP Systems Inc. Video Station versions prior to 5.5.4 on QuTScloud c4.5.4 Description: A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. Recommendations: For versions prior to 5.5.4 on QTS 4.5.2, update to version 5.5.4 or later. For versions prior to 5.5.4 on QuTS hero h4.5.2, update to version 5.5.4 or later. For versions prior to 5.5.4 on QuTScloud c4.5.4, update to version 5.5.4 or later.

The issue allows remote attackers to execute arbitrary commands via a crafted 'X-Real-IP' header. This is related to an OS command injection vulnerability in the drivers syno import user.php file.

The issue concerns a relative path traversal vulnerability. It allows remote authenticated users to upload arbitrary files via the `name` parameter.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators. This can be achieved via the `username`, `password`, `admin`, `action`, `uid`, or `modify admin` parameter.

The issue is related to a permissive regular expression vulnerability in the synophoto dsm user component of Synology Photo Station. This vulnerability allows remote authenticated users to conduct privilege escalation attacks. The attack is carried out via the `fullname` parameter.