CVE-2018-0706

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
QNAP	Q'center Virtual Appliance	1.7.1063 and earlier

References

http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/45Exploit, Mailing List, Third Party Advisory
https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitiesExploit, Third Party Advisory
https://www.exploit-db.com/exploits/45015/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45043/Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201807-10Vendor Advisory
https://www.securityfocus.com/archive/1/542141/100/0/threadedExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/45Exploit, Mailing List, Third Party Advisory
https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitiesExploit, Third Party Advisory
https://www.exploit-db.com/exploits/45015/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45043/Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201807-10Vendor Advisory
https://www.securityfocus.com/archive/1/542141/100/0/threadedExploit, Third Party Advisory, VDB Entry

Timeline

Published: Jul 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-07077.2Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated CVE-2018-07088.8Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated user CVE-2018-07098.8Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to r CVE-2018-07108.8Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to ru CVE-2018-07116.1Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow CVE-2018-07129.8Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and thei CVE-2018-07149.8Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.CVE-2018-07156.1Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code i CVE-2018-07166.1Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Q CVE-2018-07189.8Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run CVE-2018-07195.5Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: CVE-2018-07217.7Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version