CVE-2019-7201

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak Replicator 4.5.12.1108.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
n/a	QNAP NetBak Replicator	Version 4.5.11.816 and earlier

References

https://www.qnap.com/zh-tw/security-advisory/nas-201912-02Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201912-02Vendor Advisory

Timeline

Published: Dec 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72116.1SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious CVE-2019-72128.2SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and CVE-2019-72136.5SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could crea CVE-2019-72149.8SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on CVE-2019-72156.5Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but CVE-2019-72167.8An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type o CVE-2019-72177.5Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses CVE-2019-72185.9Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the CVE-2019-72196.1Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. CVE-2019-72206.1X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.CVE-2019-72217.8The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.CVE-2019-72225.5The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.