CVE Vulnerability Advisory Database

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] Roundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking

[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later