Vulnerabilidades de QNAP Systems Inc.
CVEs publicadas que afetam produtos de QNAP Systems Inc.: 260 registro(s), com severidade, exploração e correções.
QTS 76QuTS hero 69Qsync Central 64File Station 5 41QuRouter 8Video Station 8QuMagie 8Download Station 5Notes Station 3 4License Center 4QuNetSwitch 4HybridDesk Station 3Media Streaming add-on 3Hyper Data Protector 2Photo Station 2QuFTP Service 2QuLog Center 2QcalAgent 2VioStor 2Notification Center 2HBS 3 Hybrid Backup Sync 2Network & Virtual Switch 1NetBak Replicator 1QNAP Authenticator 1VioStor NVR 1Virtualization Station 1Qsirch 1HBS 3 1Helpdesk 1sMedio DTCP MOVE 1QuTS cloud 1QVP 1Qfiling 1Qfinder Pro Mac 1Malware Remover 1Qsync for Mac 1QVPN Device Client for Mac 1MARS (Multi-Application Recovery Service) 1QVR Pro 1
CVE-2025-44015
Alta · 8.4
CWE-77 29/08/2025
HybridDesk Station
A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.18 and later
CVE-2025-33038
Média · 6.5
CWE-22 29/08/2025
Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-33037
Média · 6.5
CWE-22 29/08/2025
Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-33036
Média · 6.5
CWE-22 29/08/2025
Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-33033
Média · 6.5
CWE-22 29/08/2025
Qsync Central
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-30278
Alta · 8.8
CWE-295 29/08/2025
Qsync Central
An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-30277
Alta · 8.8
CWE-295 29/08/2025
Qsync Central
An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-30275
Média · 6.5
CWE-476 29/08/2025
Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-30263
Média · 6.5
CWE-476 29/08/2025
Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVE-2025-30262
Média · 6.5
CWE-476 29/08/2025
Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVE-2025-30261
Média · 6.5
CWE-770 29/08/2025
Qsync Central
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVE-2025-30260
Média · 6.5
CWE-770 29/08/2025
Qsync Central
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-29900
Média · 6.5
CWE-770 29/08/2025
File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29899
Média · 6.5
CWE-770 29/08/2025
File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29898
Média · 6.5
CWE-400 29/08/2025
Qsync Central
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-29894
Alta · 8.8
CWE-89 29/08/2025
Qsync Central
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-29893
Alta · 8.8
CWE-89 29/08/2025
Qsync Central
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVE-2025-29890
Média · 6.5
CWE-770 29/08/2025
File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29887
Alta · 7.2
CWE-78 29/08/2025
QuRouter 2.5
A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
QuRouter 2.5.1.060 and later
CVE-2025-29889
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29888
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29886
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29879
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29878
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVE-2025-29875
Média · 6.5
CWE-476 29/08/2025
File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later