Threat database

CVE-2018-19943 is a cross-site scripting (XSS) vulnerability in QNAP NAS File Station that allows remote attackers to inject malicious code. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.

CVE-2018-19949 is a command injection vulnerability in QNAP NAS File Station that allows remote attackers to execute arbitrary commands. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

QNAP Network-Attached Storage (NAS) devices have a command injection vulnerability (CVE-2020-2509) that allows remote attackers to execute arbitrary commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

QNAP NAS devices running HBS 3 have an improper authorization vulnerability (CVE-2021-28799) that allows remote attackers to log in without proper credentials. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. The issue relates to insufficient access control, enabling unauthorized access to the device.

QNAP Helpdesk contains an improper access control vulnerability that could allow an attacker to gain elevated privileges or access sensitive information. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.