CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–10 of 11 records

CVE Vendor Product Added Due Status
CVE-2023-47565 — QNAP VioStor NVR OS Command Injection Vulnerability
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
 QNAP VioStor NVR Dec 21, 2023 Jan 11, 2024
CVE-2022-27593 — QNAP Photo Station Externally Controlled Reference Vulnerability
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
 QNAP Photo Station Sep 8, 2022 Sep 29, 2022 Ransomware
CVE-2019-7192 — QNAP Photo Station Improper Access Control Vulnerability
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
 QNAP Photo Station Jun 8, 2022 Jun 22, 2022 Ransomware
CVE-2019-7193 — QNAP QTS Improper Input Validation Vulnerability
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
 QNAP QTS Jun 8, 2022 Jun 22, 2022 Ransomware
CVE-2019-7194 — QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
 QNAP Photo Station Jun 8, 2022 Jun 22, 2022 Ransomware
CVE-2019-7195 — QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
 QNAP Photo Station Jun 8, 2022 Jun 22, 2022 Ransomware
CVE-2018-19943 — QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
 QNAP Network Attached Storage (NAS) May 24, 2022 Jun 14, 2022 Ransomware
CVE-2018-19949 — QNAP NAS File Station Command Injection Vulnerability
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
 QNAP Network Attached Storage (NAS) May 24, 2022 Jun 14, 2022 Ransomware
CVE-2018-19953 — QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
 QNAP Network Attached Storage (NAS) May 24, 2022 Jun 14, 2022 Ransomware
CVE-2020-2509 — QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
 QNAP QNAP Network-Attached Storage (NAS) Apr 11, 2022 May 2, 2022