QNAP security advisories, December 2024

Every QNAP security advisory published in December 2024, from QNAP PSIRT ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 18
Critical: 6
High: 8
In CISA KEV: 0
CVEs: 18

QNAP advisories published in December 2024

Dec 19, 2024
High [CVE-2023-23354] cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
High7.3
Dec 19, 2024
High [CVE-2022-27595] insecure library loading vulnerability has been reported to affect QVPN Device Client.
High7.8
Dec 19, 2024
Medium [CVE-2023-23357] cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.
Medium4.8
Dec 19, 2024
Medium [CVE-2023-23356] QuFirewall: command injection vulnerability has been reported to affect several QNAP operating system versions.
Medium5.5
Dec 19, 2024
Medium [CVE-2022-27600] QTS: uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions.
Medium6.8
Dec 6, 2024
Critical [CVE-2024-50393] QTS: command injection vulnerability has been reported to affect several QNAP operating system versions.
Critical9.8
Dec 6, 2024
Critical [CVE-2024-50389] SQL injection vulnerability has been reported to affect QuRouter.
Critical9.8
Dec 6, 2024
Critical [CVE-2024-50388] HBS: OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync.
Critical9.8
Dec 6, 2024
Critical [CVE-2024-50387] SQL injection vulnerability has been reported to affect several QNAP operating system versions.
Critical9.8
Dec 6, 2024
Critical [CVE-2024-48863] License Center: command injection vulnerability has been reported to affect License Center.
Critical9.8
Dec 6, 2024
Critical [CVE-2024-48859] QTS: improper authentication vulnerability has been reported to affect several QNAP operating system versions.
Critical9.1
Dec 6, 2024
High [CVE-2024-53691] QTS: link following vulnerability has been reported to affect several QNAP operating system versions.
High8.8
Dec 6, 2024
High [CVE-2024-50404] Qsync: link following vulnerability has been reported to affect Qsync Central.
High8.8
Dec 6, 2024
High [CVE-2024-50403] QTS: use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions
High7.2
Dec 6, 2024
High [CVE-2024-50402] QTS: use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions
High7.2
Dec 6, 2024
High [CVE-2024-48868] QTS: improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating…
High7.5
Dec 6, 2024
High [CVE-2024-48865] QTS: improper certificate validation vulnerability has been reported to affect several QNAP operating system versions.
High7.5
Dec 6, 2024
Medium [CVE-2024-48866] QTS: improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system…
Medium5.3

Get an email when QNAP publishes the next one.

See QNAP's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about QNAP

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.