GCVE - cpe:2.3:a:qnap:notes_station_3:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qnap:notes_station_3:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Qnap (`a402dda4-b7da-50eb-b0f8-700e564ee87d`)
Product	Notes Station 3 (`172c81ac-ec52-5233-923b-a471322597b5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-38646`	vulnerable	2026-06-08 06:41:47.824472	Notes Station 3 An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later Published: 2024-11-22T15:32:20.386Z Updated: 2024-11-22T16:49:50.421Z Open on db.gcve.eu Reference links https://www.qnap.com/en/security-advisory/qsa-24-36	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38645`	vulnerable	2026-06-08 06:41:47.823908	Notes Station 3 A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later Published: 2024-11-22T15:32:26.439Z Updated: 2024-11-22T16:52:01.922Z Open on db.gcve.eu Reference links https://www.qnap.com/en/security-advisory/qsa-24-36	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38644`	vulnerable	2026-06-08 06:41:47.823305	Notes Station 3 An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later Published: 2024-11-22T15:32:31.923Z Updated: 2024-11-22T16:50:56.156Z Open on db.gcve.eu Reference links https://www.qnap.com/en/security-advisory/qsa-24-36	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38643`	vulnerable	2026-06-08 06:41:47.822603	Notes Station 3 A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later Published: 2024-11-22T15:32:38.356Z Updated: 2024-11-22T16:51:35.154Z Open on db.gcve.eu Reference links https://www.qnap.com/en/security-advisory/qsa-24-36	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27126`	vulnerable	2026-06-08 06:31:27.629666	Notes Station 3 MEDIUM (6.3) A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: Notes Station 3 3.9.6 and later Published: 2024-09-06T16:26:37.078Z Updated: 2024-09-06T17:50:39.130Z Open on db.gcve.eu Reference links https://www.qnap.com/en/security-advisory/qsa-24-21	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27122`	vulnerable	2026-06-08 06:31:27.609107	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.