475
CVEs
67
Critical
149
High
9
KEV
27
PoC
187
Unpatched C/H
17.7%
Patch Rate
3.3%
Avg EPSS
Severity Breakdown
CRITICAL
67
HIGH
149
MEDIUM
219
LOW
40
Monthly CVE Trend
Affected Products (30)
Qts
204
Quts Hero
168
Qsync Central
61
File Station
50
Qutscloud
18
Photo Station
16
Video Station
11
Qumagie
10
Qvr
9
Qurouter
8
Q Center
7
Music Station
7
Hybrid Backup Sync
6
Notes Station 3
6
Helpdesk
5
License Center
5
Media Streaming Add On
5
Qulog Center
5
Multimedia Console
4
Qes
4
Download Station
3
Signage Station
3
Viostor Network Video Recorder
3
Netscaler Sdx Firmware
2
Qradar Security Information And Event Manager
2
Linux Enterprise Server
2
Workload Deployer
2
Enterprise Linux For Scientific Computing
2
Big Iq Security
2
Storwize V7000 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2014-6271 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 94.2% | 228 |
KEV
PoC
|
| CVE-2014-7169 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 90.1% | 209 |
KEV
PoC
|
| CVE-2017-6361 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.5%. | CRITICAL | 9.8 | 90.5% | 160 |
PoC
No patch
|
| CVE-2017-6360 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.0%. | CRITICAL | 9.8 | 80.0% | 149 |
PoC
No patch
|
| CVE-2017-13067 | QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.1%. | CRITICAL | 9.8 | 51.1% | 135 |
PoC
No patch
|
| CVE-2017-6359 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 61.4%. | CRITICAL | 9.8 | 61.4% | 130 |
PoC
No patch
|
| CVE-2018-0706 | Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 48.7% | 79 |
PoC
No patch
|
| CVE-2017-5227 | QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.5%. | HIGH | 7.5 | 19.5% | 77 |
PoC
No patch
|
| CVE-2017-7876 | This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 10.0 | 6.7% | 77 |
PoC
No patch
|
| CVE-2018-0707 | Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 59.2% | 71 |
PoC
No patch
|
| CVE-2019-7192 | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 88.2% | 69 |
KEV
PoC
No patch
|
| CVE-2019-7193 | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 14.4% | 69 |
KEV
PoC
No patch
|
| CVE-2019-7194 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 83.0% | 69 |
KEV
PoC
No patch
|
| CVE-2019-7195 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 89.7% | 69 |
KEV
PoC
No patch
|
| CVE-2021-28799 | An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 78.4% | 69 |
KEV
PoC
No patch
|