Tony Martin

A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code.

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code.

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code.

An open redirect issue has been reported, allowing attackers to redirect users to untrusted pages containing malware.

A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code.

A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero, and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code.

Name of the Vulnerable Software and Affected Versions: QmailAgent versions prior to 3.0.2 Description: A fix for the issue has been implemented in QmailAgent version 3.0.2 and later. Recommendations: For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: QNAP QmailAgent versions prior to 3.0.2 Description: A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For QNAP QmailAgent versions prior to 3.0.2, update to QmailAgent 3.0.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Media Streaming add-on versions prior to 500.0.0.3 Media Streaming add-on versions prior to 430.1.8.12 Description: A command injection issue has been reported, allowing remote attackers to run arbitrary commands on QNAP devices running the Media Streaming add-on. Recommendations: For Media Streaming add-on versions prior to 500.0.0.3, update to version 500.0.0.3 or later. For Media Streaming add-on versions prior to 430.1.8.12, update to version 430.1.8.12 or later.

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 5.4.10 Photo Station versions prior to 5.7.13 Photo Station versions prior to 6.0.18 Description: A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For Photo Station versions prior to 5.4.10, update to version 5.4.10 or later. For Photo Station versions prior to 5.7.13, update to version 5.7.13 or later. For Photo Station versions prior to 6.0.18, update to version 6.0.18 or later.

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 6.0.18 Description: A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For versions prior to 6.0.18, update to Photo Station 6.0.18 or later to resolve the issue.

A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code.

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 6.0.18 Description: A cross-site scripting (XSS) issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For versions prior to 6.0.18, update to Photo Station 6.0.18 or later to resolve the issue.

The issue is related to improper authentication of requests. Successful exploitation can lead to unauthorized changes in the settings of the Proxy Server.

The issue allows remote attackers to run arbitrary OS commands against the system with root privileges.

The issue is related to the lack of CSRF protections in the Proxy Server application.

A cross-site scripting (XSS) issue exists in the File Station of QNAP QTS, allowing remote attackers to inject arbitrary web script or HTML. This can lead to the execution of malicious code on the victim's browser.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML into the Media Streaming add-on. The injected code is triggered by a crafted link, rather than the normal page.

The issue may expose sensitive information contained in NAS devices, potentially allowing attackers to further compromise the device.