CVE-2023-32970

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network. QES is not affected.

We have already fixed the vulnerability in the following versions: QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.0.2453 build 20230708 and later QuTS hero h4.5.4.2476 build 20230728 and later QuTScloud c5.1.0.2498 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-329717.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329727.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329737.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329747.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allCVE-2023-329757.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-329767.2An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticatCVE-2023-329775.4Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a storedCVE-2023-329784.3A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server usCVE-2023-329794.3Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with OverallCVE-2023-329804.3A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an aCVE-2023-329818.8An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted aCVE-2023-329824.3Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier stores extra variables unencrypted in job config.xml files on the Jenkins controller w