CVE-2023-50359

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An unchecked return value vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated administrators to place the system in a state that could lead to a crash or other unintended behaviors via unspecified vectors.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-252

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-50368.8Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.CVE-2023-503608.8A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to CVE-2023-503618.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-503628.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-503638.1An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2023-503648.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-503664.8A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabili CVE-2023-503685.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features f CVE-2023-503695.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or lat CVE-2023-50377.2badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject CVE-2023-503705.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons CVE-2023-503715.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit