QNAP security advisories, December 2020

Every QNAP security advisory published in December 2020, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 14
Critical: 3
High: 2
In CISA KEV: 0
CVEs: 14

QNAP advisories published in December 2020

Dec 31, 2020
Critical [CVE-2018-19945] QTS: vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6.
Critical9.1
Dec 31, 2020
High [CVE-2018-19944] QTS: cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices.
High7.5
Dec 31, 2020
High [CVE-2018-19941] QTS: vulnerability has been reported to affect QNAP NAS.
High7.5
Dec 24, 2020
Critical [CVE-2020-2503] If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
Critical9.0
Dec 24, 2020
Medium [CVE-2020-2504] If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station.
Medium5.8
Dec 24, 2020
Medium [CVE-2020-2499] hard-coded password vulnerability has been reported to affect earlier versions of QES.
Medium6.3
Dec 24, 2020
Low [CVE-2020-2505] If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages.
Low2.3
Dec 10, 2020
Critical [CVE-2019-7198] QTS: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application.
Critical9.8
Dec 10, 2020
Medium [CVE-2020-2498] QTS: If exploited, this cross-site scripting vulnerability could
Medium6.1
Dec 10, 2020
Medium [CVE-2020-2497] QTS: If exploited, this cross-site scripting vulnerability could
Medium6.1
Dec 10, 2020
Medium [CVE-2020-2496] QTS: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
Medium6.1
Dec 10, 2020
Medium [CVE-2020-2494] QTS: This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code.
Medium6.1
Dec 10, 2020
Medium [CVE-2020-2493] Multimedia Console: This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code.
Medium6.1
Dec 10, 2020
Medium [CVE-2020-2491] QTS: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.
Medium6.1

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.