QNAP security advisories, May 2022

Every QNAP security advisory published in May 2022, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 10
Critical: 1
High: 3
In CISA KEV: 0
CVEs: 10

QNAP advisories published in May 2022

May 26, 2022
Medium [CVE-2021-34360] QTS: cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server.
Medium5.3
May 5, 2022
Critical [CVE-2022-27588] QVR: We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later
Critical9.8
May 5, 2022
High [CVE-2021-44057] Photo Station: improper authentication vulnerability has been reported to affect QNAP device running Photo Station.
High7.1
May 5, 2022
High [CVE-2021-44056] Video Station: improper authentication vulnerability has been reported to affect QNAP device running Video Station.
High7.1
May 5, 2022
High [CVE-2021-44051] QTS: command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS.
High8.8
May 5, 2022
Medium [CVE-2021-44055] Video Station: missing authorization vulnerability has been reported to affect QNAP device running Video Station.
Medium5.3
May 5, 2022
Medium [CVE-2021-44054] QTS: open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS.
Medium4.3
May 5, 2022
Medium [CVE-2021-44053] QTS: cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud.
Medium5.7
May 5, 2022
Medium [CVE-2021-44052] QTS: improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running…
Medium6.5
May 5, 2022
Medium [CVE-2021-38693] path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance
Medium5.3

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.