Search

Find a vulnerability

Search criteria

    9 vulnerabilities found for QVR by Qnap

    CERTFR-2024-AVI-0752

    Vulnerability from certfr_avis - Published: 2024-09-09 - Updated: 2025-01-21

    De multiples vulnérabilités ont été découvertes dans les produits Qnap. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Qnap QuTS hero QuTS hero versions h4.5.x antérieures à h4.5.4.2790 build 20240606
    Qnap QTS QTS versions 4.3.4 antérieures à 4.3.4.2814 build 20240618
    Qnap Download Station Download Station versions 5.8.x antérieures à 5.8.6.283
    Qnap QTS QTS versions 4.3.3 antérieures à 4.3.3.2784 build 20240619
    Qnap QuMagie QuMagie versions 2.3.x antérieures à 2.3.1
    Qnap QTS QTS versions 4.2.6 antérieures à 4.2.6 build 20240618
    Qnap QTS QTS versions 4.3.6 antérieures à 4.3.6.2805 build 20240619
    Qnap Helpdesk Helpdesk versions 3.3.x antérieures à 3.3.1
    Qnap Notes Station Notes Station 3 versions 3.9.x antérieures à 3.9.6
    Qnap QTS QTS versions 5.1.x antérieures à 5.2.0.2782 build 20240601
    Qnap QuTS hero QuTS hero versions h4.5.x antérieures à h4.5.4.2626 build 20231225
    Qnap QuTS hero QuTS hero versions h5.1.x antérieures à h5.2.0.2782 build 20240601
    Qnap Music Station Music Station versions 5.4.x antérieures à 5.4.0
    Qnap Video Station Video Station versions 5.8.x antérieures à 5.8.2
    Qnap QTS QTS versions 4.5.x antérieures à 4.5.4.2790 build 20240605
    Qnap QuLog Center QuLog Center versions 1.7.x.x antérieures à 1.7.0.827
    Qnap QuLog Center QuLog Center versions 1.8.x.x antérieures à 1.8.0.872
    Qnap QVR QVR Smart Client versions 2.4.x.x antérieures à 2.4.0.0570
    References
    Bulletin de sécurité Qnap QSA-24-24 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-26 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-34 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-30 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-21 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-27 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-29 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-28 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-32 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-25 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-33 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-22 2024-09-07 vendor-advisory
    Bulletin de sécurité Qnap QSA-24-35 2024-09-07 vendor-advisory

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QuTS hero versions h4.5.x ant\u00e9rieures \u00e0 h4.5.4.2790 build 20240606",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 4.3.4 ant\u00e9rieures \u00e0 4.3.4.2814 build 20240618",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Download Station versions 5.8.x ant\u00e9rieures \u00e0 5.8.6.283",
      "product": {
        "name": "Download Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 4.3.3 ant\u00e9rieures \u00e0 4.3.3.2784 build 20240619",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuMagie versions 2.3.x ant\u00e9rieures \u00e0 2.3.1",
      "product": {
        "name": "QuMagie",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 4.2.6 ant\u00e9rieures \u00e0 4.2.6 build 20240618",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 4.3.6 ant\u00e9rieures \u00e0 4.3.6.2805 build 20240619",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Helpdesk versions 3.3.x ant\u00e9rieures \u00e0 3.3.1",
      "product": {
        "name": "Helpdesk",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Notes Station 3 versions 3.9.x ant\u00e9rieures \u00e0 3.9.6",
      "product": {
        "name": "Notes Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 5.1.x ant\u00e9rieures \u00e0 5.2.0.2782 build 20240601",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions h4.5.x ant\u00e9rieures \u00e0 h4.5.4.2626 build 20231225",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions h5.1.x ant\u00e9rieures \u00e0 h5.2.0.2782 build 20240601",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Music Station versions 5.4.x ant\u00e9rieures \u00e0 5.4.0",
      "product": {
        "name": "Music Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Video Station versions 5.8.x ant\u00e9rieures \u00e0 5.8.2",
      "product": {
        "name": "Video Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 4.5.x ant\u00e9rieures \u00e0 4.5.4.2790 build 20240605",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center versions 1.7.x.x ant\u00e9rieures \u00e0 1.7.0.827",
      "product": {
        "name": "QuLog Center",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center versions 1.8.x.x ant\u00e9rieures \u00e0 1.8.0.872",
      "product": {
        "name": "QuLog Center",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVR Smart Client versions 2.4.x.x ant\u00e9rieures \u00e0 2.4.0.0570",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2022-27592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27592"
    },
    {
      "name": "CVE-2023-50360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50360"
    },
    {
      "name": "CVE-2024-32762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32762"
    },
    {
      "name": "CVE-2024-21906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21906"
    },
    {
      "name": "CVE-2024-38640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38640"
    },
    {
      "name": "CVE-2024-53691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53691"
    },
    {
      "name": "CVE-2023-34974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34974"
    },
    {
      "name": "CVE-2024-27125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27125"
    },
    {
      "name": "CVE-2024-32763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32763"
    },
    {
      "name": "CVE-2024-27126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27126"
    },
    {
      "name": "CVE-2023-47563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47563"
    },
    {
      "name": "CVE-2024-38641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38641"
    },
    {
      "name": "CVE-2024-38642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38642"
    },
    {
      "name": "CVE-2023-34979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34979"
    },
    {
      "name": "CVE-2023-39298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39298"
    },
    {
      "name": "CVE-2023-39300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39300"
    },
    {
      "name": "CVE-2023-45038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45038"
    },
    {
      "name": "CVE-2024-32771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32771"
    },
    {
      "name": "CVE-2023-38545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
    },
    {
      "name": "CVE-2024-27122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27122"
    }
  ],
  "initial_release_date": "2024-09-09T00:00:00",
  "last_revision_date": "2025-01-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0752",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-09T00:00:00.000000"
    },
    {
      "description": "Ajout de l\u0027identifiant CVE-2024-53691.",
      "revision_date": "2025-01-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Qnap. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-24",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-24"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-26",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-26"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-34",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-34"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-30",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-30"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-21",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-21"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-27",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-27"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-29",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-29"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-28",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-28"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-32",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-32"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-25",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-25"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-33",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-33"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-22",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-22"
    },
    {
      "published_at": "2024-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-24-35",
      "url": "https://www.qnap.com/go/security-advisory/qsa-24-35"
    }
  ]
}

    CERTFR-2023-AVI-1011

    Vulnerability from certfr_avis - Published: 2023-12-11 - Updated: 2023-12-11

    De multiples vulnérabilités ont été découvertes dans les produits Qnap. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire et une injection de code indirecte à distance (XSS).

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QuTS hero Qnap QuTS hero h5.0.x versions antérieures à h5.0.1.2515 build 20230907
    Qnap QTS Qnap QTS 5.0.x versions antérieures à 5.0.1.2514 build 20230906
    Qnap QTS Qnap QTS 4.5.x versions antérieures à 4.5.4.2467 build 20230718
    Qnap QTS Qnap QTS 5.1.x versions antérieures à 5.1.3.2578 build 20231110
    Qnap QVR Qnap QVR Firmware 4.x versions antérieures à 5.x
    Qnap QuTS hero Qnap QuTS hero h5.1.x versions antérieures à h5.1.3.2578 build 20231110
    Qnap QuTS hero Qnap QuTS hero h4.5.x versions antérieures à h4.5.4.2476 build 20230728
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Qnap QuTS hero h5.0.x versions ant\u00e9rieures \u00e0 h5.0.1.2515 build 20230907",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS 5.0.x versions ant\u00e9rieures \u00e0 5.0.1.2514 build 20230906",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS 4.5.x versions ant\u00e9rieures \u00e0 4.5.4.2467 build 20230718",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS 5.1.x versions ant\u00e9rieures \u00e0 5.1.3.2578 build 20231110",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QVR Firmware 4.x versions ant\u00e9rieures \u00e0 5.x",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QuTS hero h5.1.x versions ant\u00e9rieures \u00e0 h5.1.3.2578 build 20231110",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QuTS hero h4.5.x versions ant\u00e9rieures \u00e0 h4.5.4.2476 build 20230728",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-4091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4091"
    },
    {
      "name": "CVE-2023-42669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42669"
    },
    {
      "name": "CVE-2023-42670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42670"
    },
    {
      "name": "CVE-2023-4154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4154"
    },
    {
      "name": "CVE-2023-23372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23372"
    },
    {
      "name": "CVE-2023-3961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3961"
    },
    {
      "name": "CVE-2023-32975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32975"
    },
    {
      "name": "CVE-2023-32968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-32968"
    },
    {
      "name": "CVE-2023-47565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47565"
    }
  ],
  "initial_release_date": "2023-12-11T00:00:00",
  "last_revision_date": "2023-12-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-1011",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Qnap\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une\nex\u00e9cution de code arbitraire et une injection de code indirecte \u00e0\ndistance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-07 du 09 d\u00e9cembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-07"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-40 du 09 d\u00e9cembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-40"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-48 du 09 d\u00e9cembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-48"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-20 du 09 d\u00e9cembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-20"
    }
  ]
}

    CERTFR-2023-AVI-0721

    Vulnerability from certfr_avis - Published: 2023-09-08 - Updated: 2023-09-08

    De multiples vulnérabilités ont été découvertes dans les produits Qnap. Certaines d'entre elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), une atteinte à la confidentialité des données et une exécution de code arbitraire.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QuLog Center QuLog Center pour QuTscloud c5.0.1 versions 1.4.x antérieures à 1.4.1.691
    Qnap N/A QuFirewall versions 2.3.x antérieures à 2.3.3
    Qnap N/A QuLog Center pour QTS 4.5.4 versions 1.3.x antérieures à 1.3.1.645
    Qnap QVR QVR Pro Client versions 2.3.x antérieures à 2.3.0.0420
    Qnap N/A QuLog Center pour QTS 5.0.1 versions 1.5.x antérieures à 1.5.0.738
    Qnap N/A QuLog Center pour QuTS hero h4.5.4 versions 1.3.x antérieures à 1.3.1.645
    Qnap N/A QuLog Center pour QuTS hero h5.0.1 versions 1.5.x antérieures à 1.5.0.738
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QuLog Center pour QuTscloud c5.0.1 versions 1.4.x ant\u00e9rieures \u00e0 1.4.1.691",
      "product": {
        "name": "QuLog Center",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuFirewall versions 2.3.x ant\u00e9rieures \u00e0 2.3.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center pour QTS 4.5.4 versions 1.3.x ant\u00e9rieures \u00e0 1.3.1.645",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVR Pro Client versions 2.3.x ant\u00e9rieures \u00e0 2.3.0.0420",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center pour QTS 5.0.1 versions 1.5.x ant\u00e9rieures \u00e0 1.5.0.738",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center pour QuTS hero h4.5.4 versions 1.3.x ant\u00e9rieures \u00e0 1.3.1.645",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuLog Center pour QuTS hero h5.0.1 versions 1.5.x ant\u00e9rieures \u00e0 1.5.0.738",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-23356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23356"
    },
    {
      "name": "CVE-2023-23354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23354"
    },
    {
      "name": "CVE-2023-23357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23357"
    },
    {
      "name": "CVE-2022-27599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27599"
    }
  ],
  "initial_release_date": "2023-09-08T00:00:00",
  "last_revision_date": "2023-09-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0721",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-09-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Qnap\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0\ndistance (XSS), une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une\nex\u00e9cution de code arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-13 du 08 septembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-13"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-08 du 08 septembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-08"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-14 du 08 septembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-14"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-16 du 08 septembre 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-16"
    }
  ]
}

    CERTFR-2023-AVI-0602

    Vulnerability from certfr_avis - Published: 2023-07-28 - Updated: 2023-07-28

    De multiples vulnérabilités ont été découvertes dans les produits Qnap. Elles permettent à un attaquant de provoquer un déni de service à distance et une exécution de code arbitraire.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QVR QVR Pro Appliance versions antérieures à 2.3.1.0476
    Qnap QTS QTS versions antérieures à 4.5.4.2280 build 20230112
    Qnap QuTS hero QuTS hero versions antérieures à h4.5.4.2374 build 20230417
    Qnap N/A QVPN Device Client pour Windows versions antérieures à 2.0.0.1316
    Qnap N/A QuTScloud versions antérieures à c5.0.1.2374 build 20230419
    Qnap QTS QTS versions antérieures à 5.0.1.2277 build 20230112
    Qnap QuTS hero QuTS hero versions antérieures à h5.0.1.2277 build 20230112
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVR Pro Appliance versions ant\u00e9rieures \u00e0 2.3.1.0476",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions ant\u00e9rieures \u00e0 4.5.4.2280 build 20230112",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions ant\u00e9rieures \u00e0 h4.5.4.2374 build 20230417",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVPN Device Client pour Windows versions ant\u00e9rieures \u00e0 2.0.0.1316",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTScloud versions ant\u00e9rieures \u00e0 c5.0.1.2374 build 20230419",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions ant\u00e9rieures \u00e0 5.0.1.2277 build 20230112",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions ant\u00e9rieures \u00e0 h5.0.1.2277 build 20230112",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-27600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27600"
    },
    {
      "name": "CVE-2022-27595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27595"
    }
  ],
  "initial_release_date": "2023-07-28T00:00:00",
  "last_revision_date": "2023-07-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0602",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-07-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Qnap\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service \u00e0 distance et une ex\u00e9cution de code\narbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-04 du 28 juillet 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-09 du 28 juillet 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-09"
    }
  ]
}

    CERTFR-2022-AVI-421

    Vulnerability from certfr_avis - Published: 2022-05-06 - Updated: 2022-05-06

    De multiples vulnérabilités ont été découvertes dans les produits Qnap. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap N/A Qnap Photo Station versions antérieures à 6.0.20 (2022/02/15)
    Qnap N/A Qnap Photo Station versions antérieures à 5.4.13 (2022/02/11)
    Qnap N/A Qnap Photo Station versions antérieures à 5.7.16 (2022/02/11)
    Qnap Video Station Qnap Video Station versions antérieures à 5.3.13
    Qnap QTS Qnap QTS versions antérieures à 4.5.4.1991 build 20220329
    Qnap QTS Qnap QTS versions antérieures à 4.3.4.1976 build 20220303
    Qnap N/A Qnap QuTScloud versions antérieures à c5.0.1.1998
    Qnap QTS Qnap QTS versions antérieures à 4.2.6 build 20220304
    Qnap QTS Qnap QTS versions antérieures à 4.3.3.1945 build 20220303
    Qnap QTS Qnap QTS versions antérieures à 5.0.0.1986 build 20220324
    Qnap Video Station Qnap Video Station versions antérieures à 5.5.9
    Qnap QTS Qnap QTS versions antérieures à 4.3.6.1965 build 20220302
    Qnap QVR Qnap QVR versions antérieures à 5.1.6 build 20220401
    Qnap Video Station Qnap Video Station versions antérieures à 5.1.8
    Qnap QuTS hero Qnap QuTS hero versions antérieures à h5.0.0.1986 build 20220324
    Qnap QuTS hero Qnap QuTS hero versions antérieures à h4.5.4.1971 build 20220310
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Qnap Photo Station versions ant\u00e9rieures \u00e0 6.0.20 (2022/02/15)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap Photo Station versions ant\u00e9rieures \u00e0 5.4.13 (2022/02/11)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap Photo Station versions ant\u00e9rieures \u00e0 5.7.16 (2022/02/11)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap Video Station versions ant\u00e9rieures \u00e0 5.3.13",
      "product": {
        "name": "Video Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 4.5.4.1991 build 20220329",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 4.3.4.1976 build 20220303",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QuTScloud versions ant\u00e9rieures \u00e0 c5.0.1.1998",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 4.2.6 build 20220304",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 4.3.3.1945 build 20220303",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 5.0.0.1986 build 20220324",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap Video Station versions ant\u00e9rieures \u00e0 5.5.9",
      "product": {
        "name": "Video Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QTS versions ant\u00e9rieures \u00e0 4.3.6.1965 build 20220302",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QVR versions ant\u00e9rieures \u00e0 5.1.6 build 20220401",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap Video Station versions ant\u00e9rieures \u00e0 5.1.8",
      "product": {
        "name": "Video Station",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QuTS hero versions ant\u00e9rieures \u00e0 h5.0.0.1986 build 20220324",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qnap QuTS hero versions ant\u00e9rieures \u00e0 h4.5.4.1971 build 20220310",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-44056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44056"
    },
    {
      "name": "CVE-2022-44057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44057"
    },
    {
      "name": "CVE-2022-44053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44053"
    },
    {
      "name": "CVE-2022-44052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44052"
    },
    {
      "name": "CVE-2022-44054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44054"
    },
    {
      "name": "CVE-2022-27588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27588"
    },
    {
      "name": "CVE-2022-44055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44055"
    },
    {
      "name": "CVE-2022-38693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38693"
    },
    {
      "name": "CVE-2022-44051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-44051"
    }
  ],
  "initial_release_date": "2022-05-06T00:00:00",
  "last_revision_date": "2022-05-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-421",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-05-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Qnap.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-22-13 du 6 mai 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-22-13"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-22-14 du 6 mai 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-22-14"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-22-07 du 6 mai 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-22-07"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-22-15 du 6 mai 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-22-15"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-22-16 du 6 mai 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-22-16"
    }
  ]
}

    CERTFR-2022-AVI-033

    Vulnerability from certfr_avis - Published: 2022-01-13 - Updated: 2022-01-13

    De multiples vulnérabilités ont été découvertes dans les produits QNAP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une injection de code indirecte à distance (XSS).

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QTS QTS 4.5.x versions antérieures à 4.5.4.1892 build 20211223
    Qnap N/A QcalAgent versions antérieures à 1.1.7
    Qnap QVR QVR Pro versions antérieures à 2.1.3.0 du 06/12/2021
    Qnap QTS QTS 5.0.x versions antérieures à 5.0.0.1891 build 20211221
    Qnap QVR QVR Guard versions antérieures à 2.1.3.0 du 06/12/2021
    Qnap QuTS hero QuTS hero versions antérieures à h5.0.0.1892 build 20211222
    Qnap QVR QVR Elite versions antérieures à 2.1.4.0 du 06/12/2021
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QTS 4.5.x versions ant\u00e9rieures \u00e0 4.5.4.1892 build 20211223",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QcalAgent versions ant\u00e9rieures \u00e0 1.1.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVR Pro versions ant\u00e9rieures \u00e0 2.1.3.0 du 06/12/2021",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS 5.0.x versions ant\u00e9rieures \u00e0 5.0.0.1891 build 20211221",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVR Guard versions ant\u00e9rieures \u00e0 2.1.3.0 du 06/12/2021",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions ant\u00e9rieures \u00e0 h5.0.0.1892 build 20211222",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVR Elite versions ant\u00e9rieures \u00e0 2.1.4.0 du 06/12/2021",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-38690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38690"
    },
    {
      "name": "CVE-2021-38677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38677"
    },
    {
      "name": "CVE-2021-38691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38691"
    },
    {
      "name": "CVE-2021-38678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38678"
    },
    {
      "name": "CVE-2021-38692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38692"
    },
    {
      "name": "CVE-2021-38689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38689"
    },
    {
      "name": "CVE-2021-38682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38682"
    }
  ],
  "initial_release_date": "2022-01-13T00:00:00",
  "last_revision_date": "2022-01-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-033",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits QNAP.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits QNAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-21-57 du 13 janvier 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-57"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-21-60 du 13 janvier 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-60"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP qsa-21-59 du 13 janvier 2022",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-59"
    }
  ]
}

    CERTFR-2021-AVI-906

    Vulnerability from certfr_avis - Published: 2021-11-29 - Updated: 2021-11-29

    De multiples vulnérabilités ont été découvertes dans Qnap QVR. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QVR QVR versions antérieures à 5.1.6 build 20211109
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVR versions ant\u00e9rieures \u00e0 5.1.6 build 20211109",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-38685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38685"
    },
    {
      "name": "CVE-2021-38686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38686"
    }
  ],
  "initial_release_date": "2021-11-29T00:00:00",
  "last_revision_date": "2021-11-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-906",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-11-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Qnap QVR. Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Qnap QVR",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-21-52 du 26 novembre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-52"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap qsa-21-51 du 26 novembre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-51"
    }
  ]
}

    CERTFR-2021-AVI-746

    Vulnerability from certfr_avis - Published: 2021-10-01 - Updated: 2021-10-01

    De multiples vulnérabilités ont été découvertes dans les produits QNAP. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une injection de code indirecte à distance (XSS).

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QVR QVR versions antérieures à 5.1.5 build 20210902
    Qnap N/A Photo Station versions 5.4.x antérieures à 5.4.10
    Qnap N/A Image2PDF versions antérieures à 2.1.5
    Qnap N/A Photo Station versions 6.0.x antérieures à 6.0.18
    Qnap N/A Photo Station versions 5.7.x antérieures à 5.7.13
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVR versions ant\u00e9rieures \u00e0 5.1.5 build 20210902",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Photo Station versions 5.4.x ant\u00e9rieures \u00e0 5.4.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Image2PDF versions ant\u00e9rieures \u00e0 2.1.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Photo Station versions 6.0.x ant\u00e9rieures \u00e0 6.0.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Photo Station versions 5.7.x ant\u00e9rieures \u00e0 5.7.13",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-34354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34354"
    },
    {
      "name": "CVE-2021-34355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34355"
    },
    {
      "name": "CVE-2021-34352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34352"
    },
    {
      "name": "CVE-2021-38675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38675"
    },
    {
      "name": "CVE-2021-34356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34356"
    }
  ],
  "initial_release_date": "2021-10-01T00:00:00",
  "last_revision_date": "2021-10-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-746",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-10-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits QNAP.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et une injection de code indirecte \u00e0 distance\n(XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits QNAP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-41 du 1 octobre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-41"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-43 du 1 octobre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-43"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-38 du 1 octobre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-38"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-42 du 1 octobre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-42"
    }
  ]
}

    CERTFR-2021-AVI-738

    Vulnerability from certfr_avis - Published: 2021-09-27 - Updated: 2021-09-27

    De multiples vulnérabilités ont été découvertes dans QNAP QVR. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Qnap QVR QVR versions antérieures à 5.1.5 build 20210803
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVR versions ant\u00e9rieures \u00e0 5.1.5 build 20210803",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-34351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34351"
    },
    {
      "name": "CVE-2021-34348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34348"
    },
    {
      "name": "CVE-2021-34349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34349"
    }
  ],
  "initial_release_date": "2021-09-27T00:00:00",
  "last_revision_date": "2021-09-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-738",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-09-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans QNAP QVR. Elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans QNAP QVR",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 QNAP QSA-21-35 du 27 septembre 2021",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-21-35"
    }
  ]
}