Known vulnerabilities in QuTS hero - page 12

Vendor: QNAP Systems, Inc.
Software: QuTS hero
Software CPE: cpe:2.3:h:qnap_systems:quts-hero:*:*:*:*:*:*:*:*
Website: https://www.qnap.com
Total vulnerabilities: 293
Public exploits: 16
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting QuTS hero QuTS hero is affected by 293 known vulnerabilities: 5 critical, 42 high, 98 medium, 148 low Critical High Medium Low

Vulnerabilities (293)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU80846 - Out-of-bounds write
CVE-2023-23359		 CWE-787 Medium
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2348 build 20230324 18.09.2023 SB2023091809
#VU80844 - Out-of-bounds write
CVE-2023-23358		 CWE-787 Medium
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2348 build 20230324 18.09.2023 SB2023091809
#VU80843 - NULL Pointer Dereference
CVE-2023-23361		 CWE-476 Medium
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2348 build 20230324 18.09.2023 SB2023091809
#VU80841 - NULL Pointer Dereference
CVE-2023-23360		 CWE-476 Medium
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2348 build 20230324 18.09.2023 SB2023091809
#VU80837 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-23362		 CWE-78 Medium
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2376 build 20230421 18.09.2023 SB2023091808
#VU80562 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23357		 CWE-79 Low
No
No
 h4.5.4, h5.0.1 08.09.2023 SB2023090830
#VU80561 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23354		 CWE-79 Low
No
No
 h4.5.4, h5.0.1 08.09.2023 SB2023090830
#VU80414 - Cleartext Transmission of Sensitive Information
CVE-2023-34972		 CWE-319 Low
No
No
 h5.1.0.2424 build 20230609 05.09.2023 SB2023090526
#VU80413 - Insufficient Entropy
CVE-2023-34973		 CWE-331 Low
No
No
 h5.1.0.2424 build 20230609 05.09.2023 SB2023090525
#VU80412 - Inadequate Encryption Strength
CVE-2023-34971		 CWE-326 Low
No
No
 h4.5.4.2476 build 20230728, h5.1.0.2424 build 20230609 05.09.2023 SB2023090524
#VU78741 - Resource exhaustion
CVE-2022-27600		 CWE-400 Low
No
No
 h4.5.4.2374 build 20230417, h5.0.1.2277 build 20230112 28.07.2023 SB2023072811
#VU74200 - Command injection
CVE-2023-23355		 CWE-77 Medium
No
No
 h5.0.1.2348 build 20230324 30.03.2023 SB2023033031
#VU74195 - Exposure of sensitive information to an unauthorized actor
CVE-2022-27598		 CWE-200 Medium
No
No
 h5.0.1.2348 build 20230324 30.03.2023 SB2023033031
#VU74194 - Exposure of sensitive information to an unauthorized actor
CVE-2022-27597		 CWE-200 Medium
No
No
 h5.0.1.2348 build 20230324 30.03.2023 SB2023033031
#VU71993 - Information Exposure Through Timing Discrepancy
CVE-2022-4304		 CWE-208 Medium
No
No
 h5.0.1.2348 build 20230324 07.02.2023 SB2023020742
SB2023020748
SB2023020767
and 222 more
#VU71992 - Type confusion
CVE-2023-0286		 CWE-843 High
No
No
 h5.0.1.2348 build 20230324 07.02.2023 SB2023020742
SB2023020747
SB2023020748
and 223 more
#VU71332 - Improper input validation
CVE-2023-22809		 CWE-20 Low
Available
No
 h5.0.1.2348 build 20230324 18.01.2023 SB20230118100
SB20230118104
SB20230118105
and 55 more
#VU71243 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2022-37436		 CWE-113 Medium
No
No
 h5.1.0.2392 build 20230508 17.01.2023 SB2023011740
SB2023011805
SB2023012728
and 33 more
#VU68701 - Heap-based Buffer Overflow
CVE-2022-3437		 CWE-122 Low
No
No
 h5.0.1.2348 build 20230324 25.10.2022 SB2022102524
SB2022102558
SB2022102521
and 33 more
#VU68700 - UNIX Symbolic Link (Symlink) Following
CVE-2022-3592		 CWE-61 Medium
No
No
 h5.0.1.2348 build 20230324 25.10.2022 SB2022102524
SB2023033037
SB2023091702
and 4 more


Showing elements 221 - 240 out of 293