CVE-2020-36197

An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.

• CWE-284
• CWE-22

• http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.htmlPatch, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-08Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-591/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.htmlPatch, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-08Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-591/Third Party Advisory, VDB Entry

Published

May 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36191JupyterHub 1.1.0 allows CSRF in the admin panel via a reques…4.5
• CVE-2020-36192An issue was discovered in the Source Integration plugin bef…5.3
• CVE-2020-36193Tar.php in Archive_Tar through 1.4.11 allows write operation…7.5
• CVE-2020-36194An XSS vulnerability has been reported to affect QNAP NAS ru…6.1
• CVE-2020-36195An SQL injection vulnerability has been reported to affect Q…9.8
• CVE-2020-36196A stored XSS vulnerability has been reported to affect QNAP …6.1
• CVE-2020-36198A command injection vulnerability has been reported to affec…6.7
• CVE-2020-36199TinyCheck before commits 9fd360d and ea53de8 was vulnerable …9.8
• CVE-2020-3620u'Lack of check of integer overflow while doing a round up o…5.5
• CVE-2020-36200TinyCheck before commits 9fd360d and ea53de8 allowed an auth…6.5
• CVE-2020-36201An issue was discovered in certain Xerox WorkCentre products…7.5
• CVE-2020-36202An issue was discovered in the async-h1 crate before 2.3.0 f…6.1