QNAP security advisories, September 2024

Every QNAP security advisory published in September 2024, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 25
Critical: 0
High: 12
In CISA KEV: 0
CVEs: 25

QNAP advisories published in September 2024

Sep 6, 2024
High [CVE-2024-38642] QuMagie: improper certificate validation vulnerability has been reported to affect QuMagie.
High7.8
Sep 6, 2024
High [CVE-2024-38641] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
High7.8
Sep 6, 2024
High [CVE-2024-32763] QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
High8.8
Sep 6, 2024
High [CVE-2024-32762] cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center.
High8.2
Sep 6, 2024
High [CVE-2024-21898] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Sep 6, 2024
High [CVE-2024-21897] QTS: cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
High8.9
Sep 6, 2024
High [CVE-2023-51366] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
High8.7
Sep 6, 2024
High [CVE-2023-50360] Video Station: SQL injection vulnerability has been reported to affect Video Station.
High8.8
Sep 6, 2024
High [CVE-2023-47563] Video Station: OS command injection vulnerability has been reported to affect Video Station.
High7.4
Sep 6, 2024
High [CVE-2023-39300] QTS: OS command injection vulnerability has been reported to affect legacy QTS.
High7.2
Sep 6, 2024
High [CVE-2023-39298] QTS: missing authorization vulnerability has been reported to affect several QNAP operating system versions.
High7.8
Sep 6, 2024
High [CVE-2023-34974] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Sep 6, 2024
Medium [CVE-2024-38640] cross-site scripting (XSS) vulnerability has been reported to affect Download Station.
Medium5.4
Sep 6, 2024
Medium [CVE-2024-27126] cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.
Medium6.3
Sep 6, 2024
Medium [CVE-2024-21906] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium4.7
Sep 6, 2024
Medium [CVE-2024-21904] QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
Medium5.9
Sep 6, 2024
Medium [CVE-2024-21903] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium6.6
Sep 6, 2024
Medium [CVE-2023-51368] QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
Medium5.4
Sep 6, 2024
Medium [CVE-2023-51367] QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
Medium5.4
Sep 6, 2024
Medium [CVE-2023-50366] QTS: cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
Medium4.3
Sep 6, 2024
Medium [CVE-2023-45038] Music Station: improper authentication vulnerability has been reported to affect Music Station.
Medium4.3
Sep 6, 2024
Medium [CVE-2023-34979] QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium6.6
Sep 6, 2024
Medium [CVE-2022-27592] QVR: unquoted search path or element vulnerability has been reported to affect QVR Smart Client.
Medium6.7
Sep 6, 2024
Low [CVE-2024-32771] QTS: improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating…
Low2.6
Sep 6, 2024
Low [CVE-2024-27125] Helpdesk: cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk.
Low3.5

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.