CVE-2020-36195

CRITICAL Year: 2020
CVSS v3 Score
9.8
Critical
CVSS v2 Score
7.5
High
Weakness Type
CWE-20
View all →

Vulnerability Description

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later

Related Vulnerabilities

CVE-2002-2444

CRITICAL
CVSS:9.8(Critical)

Snoopy before 2.0.0 has a security hole in exec cURL

CWE-202002

CVE-2009-4488

CRITICAL
CVSS:9.8(Critical)

Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2009-4491

CRITICAL
CVSS:9.8(Critical)

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2010-0748

CRITICAL
CVSS:9.8(Critical)

Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.

CWE-202010

CVE-2010-2447

CRITICAL
CVSS:9.8(Critical)

gitolite before 1.4.1 does not filter src/ or hooks/ from path names.

CWE-202010