QNAP security advisories, February 2024

Every QNAP security advisory published in February 2024, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 22
Critical: 1
High: 4
In CISA KEV: 0
CVEs: 22

QNAP advisories published in February 2024

Feb 13, 2024
Medium [CVE-2023-50358] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium5.8
Feb 13, 2024
Medium [CVE-2023-47218] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium5.8
Feb 2, 2024
Critical [CVE-2023-45025] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Critical9.0
Feb 2, 2024
High [CVE-2023-47568] QTS: SQL injection vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Feb 2, 2024
High [CVE-2023-47564] Qsync: incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central.
High8.0
Feb 2, 2024
High [CVE-2023-47562] Photo Station: OS command injection vulnerability has been reported to affect Photo Station.
High7.4
Feb 2, 2024
High [CVE-2023-39297] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Feb 2, 2024
Medium [CVE-2023-47567] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium4.7
Feb 2, 2024
Medium [CVE-2023-47566] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium6.7
Feb 2, 2024
Medium [CVE-2023-47561] Photo Station: cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-45028] QTS: uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-45027] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-41283] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-41280] QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
Medium5.5
Feb 2, 2024
Medium [CVE-2023-41274] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-41273] QTS: heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Feb 2, 2024
Medium [CVE-2023-39303] QTS: improper authentication vulnerability has been reported to affect several QNAP operating system versions.
Medium5.3
Feb 2, 2024
Medium [CVE-2023-39302] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium6.6
Feb 2, 2024
Medium [CVE-2023-32967] QTS: incorrect authorization vulnerability has been reported to affect several QNAP operating system versions.
Medium5.0
Feb 2, 2024
Low [CVE-2023-50359] QTS: unchecked return value vulnerability has been reported to affect several QNAP operating system versions.
Low3.4
Feb 2, 2024
Low [CVE-2023-45037] QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
Low3.8
Feb 2, 2024
Low [CVE-2023-45035] QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
Low3.8

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.