Karzemrok

QNAP QSA-24-20 : License Center - Authenticated remote code execution - CVE-2024-21903

QSA-24-20 - The vulnerability CVE-2024-21903 allows an authenticated administrator or delegated user to execute arbitrary commands

September 15, 2024

QNAP QSA-24-25 : Music Station - Unauthenticated file read and authentication bypass - CVE-2023-45038

QSA-24-25 - The vulnerability CVE-2023-45038 allows an unauthenticated attacker to bypass the authentication and read arbitrary files as root

September 7, 2024

QNAP QSA-22-14 : VideoStation - Multiple Vulnerabilities

The first vulnerably allows an unauthenticated attacker to leak video filename and id. The second vulnerability allows an authenticated user without access to the VideoStation application to bypass application privileges checking

May 6, 2022

QNAP QSA-22-15 : PhotoStation - Application Privileges Checking Bypass

This vulnerability allows an authenticated user without access to the PhotoStation application to bypass application privileges checking

May 6, 2022

QNAP QSA-21-25 : Helpdesk - A simple user without privileges can gain administrative access on the NAS

This vulnerability allows a simple user to enable SSH access to the NAS and get the password of the _qnap_support account. This account is sudoers on the device.

June 11, 2021

Synology SA-20:25 : SafeAccess - Multiple Vulnerabilities

Multiple Stored XSS and SQLite Injection vulnerabilities in the Safe Access (1.2.1-0220) package.

November 24, 2020

CVE-2020-25867 : SoPlanning Sharing Key Bypass

A PHP type Juggling attack that allows an unauthenticated attacker to access the content of the calendar without knowing the sharing key

July 21, 2020

Synology SA-18-15 : Photo Station - Privilege Escalation and CRLF

Multiple vulnerabilities allow remote attackers to hijack the authentication of administrators or to conduct privilege escalation attacks via a susceptible version of Photo Station.

March 29, 2018

Synology SA-17:17 : Surveillance Station - Path Traversal

A Path Traversal vulnerability allowing an authenticated user with access to Surveillance Station service can access pictures on the whole system

December 12, 2017