QNAP QTS 4.3.4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*

part: o version: 4.3.4 update: *

VendorQnap (a402dda4-b7da-50eb-b0f8-700e564ee87d)
ProductQts (9004baf2-b431-53ba-b074-38fcdcfcd981)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-28799 not_vulnerable 2026-06-08 05:31:24.899116 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
CRITICAL (10)
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
Published: 2021-05-13T02:55:13.827Z
Updated: 2025-10-21T23:25:45.551Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-2491 not_vulnerable 2026-06-08 05:24:59.298068 Cross-site Scripting Vulnerability in Photo Station
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later
Published: 2020-12-10T03:34:06.628Z
Updated: 2024-09-17T00:56:10.939Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-7197 vulnerable 2026-06-08 05:14:14.064822 Details available
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.
Published: 2019-12-04T16:45:00.000Z
Updated: 2024-08-04T20:38:33.491Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-19952 not_vulnerable 2026-06-08 05:11:16.471714 Details available
If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Published: 2020-11-02T15:57:02.626Z
Updated: 2024-09-17T02:58:07.767Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-19951 not_vulnerable 2026-06-08 05:11:16.470989 Details available
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Published: 2020-11-02T15:57:02.569Z
Updated: 2024-09-16T20:22:27.691Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-19950 not_vulnerable 2026-06-08 05:11:16.469365 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-19942 vulnerable 2026-06-08 05:11:16.421363 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-14749 vulnerable 2026-06-08 05:10:53.423631 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-14748 vulnerable 2026-06-08 05:10:53.423185 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-14747 vulnerable 2026-06-08 05:10:53.422700 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-14746 vulnerable 2026-06-08 05:10:53.421628 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0729 not_vulnerable 2026-06-08 05:10:24.581110 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0722 not_vulnerable 2026-06-08 05:10:24.573033 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0721 vulnerable 2026-06-08 05:10:24.572690 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0719 vulnerable 2026-06-08 05:10:24.572219 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0718 not_vulnerable 2026-06-08 05:10:24.570639 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0716 vulnerable 2026-06-08 05:10:24.568001 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-0714 not_vulnerable 2026-06-08 05:10:24.565538 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-13072 vulnerable 2026-06-08 05:08:48.295134 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-13071 not_vulnerable 2026-06-08 05:08:48.293629 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.