Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-34328 State: PUBLISHED Published: 2021-07-13T11:03:44 Last Updated: 2024-08-04T00:05:52.483Z Vendors: Siemens Products: JT2Go, Solid Edge SE2021, Teamcenter Visualization Problem Types: CWE-122 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current proces
th heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13424) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-866/
CVE ID: CVE-2021-34329 State: PUBLISHED Published: 2021-07-13T11:03:45 Last Updated: 2024-08-04T00:05:52.504Z Vendors: Siemens Products: JT2Go, Solid Edge SE2021, Teamcenter Visualization Problem Types: CWE-122 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current proces
th heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-867/
CVE ID: CVE-2021-34330 State: PUBLISHED Published: 2021-07-13T11:03:46 Last Updated: 2024-08-04T00:05:52.518Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-416 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13430) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.si
current process. (ZDI-CAN-13430) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-868/
CVE ID: CVE-2021-34331 State: PUBLISHED Published: 2021-07-13T11:03:47 Last Updated: 2024-08-04T00:05:52.533Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13442) Additional Analyst Notes: - CVE Program Container: Reference
code in the context of the current process. (ZDI-CAN-13442) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-869/
CVE ID: CVE-2021-34332 State: PUBLISHED Published: 2021-07-13T11:03:48 Last Updated: 2024-08-04T00:05:52.479Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-835 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition that leads to denial of service condition. An attacker could leverage this vulnerability to consume excessive resources. (CNVD-C-2021-79300) Additional Analyst Notes: - CVE Program Containe
this vulnerability to consume excessive resources. (CNVD-C-2021-79300) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE ID: CVE-2021-34333 State: PUBLISHED Published: 2021-07-13T11:03:48 Last Updated: 2024-08-04T00:05:52.513Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-415 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial of service condition. (CNVD-C-2021-79295) Additional Analyst Notes: - CVE Program Container: Ref
ability to cause denial of service condition. (CNVD-C-2021-79295) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
CVE ID: CVE-2021-34334 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T00:05:52.788Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-835 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Prog
im into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p - https://github.com/Exiv2/exiv2/pull/1766 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-34335 State: PUBLISHED Published: 2021-08-09T00:00:00 Last Updated: 2024-08-04T00:05:52.591Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Exiv2 Products: exiv2 Problem Types: CWE-369 Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into runni
tacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-pvjp-m4f6-q984 - https://github.com/Exiv2/exiv2/pull/1750 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ - https://security.gentoo.org/glsa/202312-06
CVE ID: CVE-2021-34337 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:13:25.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/mailman/mailman/-/issues/911 - https://git
Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/mailman/mailman/-/issues/911 - https://gitlab.com/mailman/mailman/-/tags - https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51
CVE ID: CVE-2021-34338 State: PUBLISHED Published: 2022-03-07T22:26:35 Last Updated: 2024-08-04T00:05:52.573Z Vendors: n/a Products: ming Problem Types: CWE-125 Description: Ming 0.4.8 has an out-of-bounds buffer overwrite issue in the function getName() in decompiler.c file that causes a direct segmentation fault and leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/201 - https://bugzilla.redhat.com/show_bug.cgi?id=1969616
CVE ID: CVE-2021-34339 State: PUBLISHED Published: 2022-03-07T22:26:20 Last Updated: 2024-08-04T00:05:52.726Z Vendors: n/a Products: ming Problem Types: CWE-125 Description: Ming 0.4.8 has an out-of-bounds buffer access issue in the function getString() in decompiler.c file that causes a direct segmentation fault and leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/202 - https://bugzilla.redhat.com/show_bug.cgi?id=1969607
CVE ID: CVE-2021-34340 State: PUBLISHED Published: 2022-03-07T22:02:09 Last Updated: 2024-08-04T00:05:52.501Z Vendors: n/a Products: ming Problem Types: CWE-125 Description: Ming 0.4.8 has an out-of-bounds buffer access issue in the function decompileINCR_DECR() in decompiler.c file that causes a direct segmentation fault and leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/203 - https://bugzilla.redhat.com/show_bug.cgi?id=1969612
CVE ID: CVE-2021-34341 State: PUBLISHED Published: 2022-03-07T22:01:52 Last Updated: 2024-08-04T00:05:52.650Z Vendors: n/a Products: ming Problem Types: CWE-125 Description: Ming 0.4.8 has an out-of-bounds read vulnerability in the function decompileIF() in the decompile.c file that causes a direct segmentation fault and leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/204 - https://bugzilla.redhat.com/show_bug.cgi?id=1969628
CVE ID: CVE-2021-34342 State: PUBLISHED Published: 2022-03-07T22:01:05 Last Updated: 2024-08-04T00:05:52.568Z Vendors: n/a Products: ming Problem Types: CWE-125 Description: Ming 0.4.8 has an out-of-bounds read vulnerability in the function newVar_N() in decompile.c which causes a huge information leak. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libming/libming/issues/205 - https://bugzilla.redhat.com/show_bug.cgi?id=1969619
CVE ID: CVE-2021-34343 State: PUBLISHED Published: 2021-09-10T04:00:23.084450Z Last Updated: 2024-09-16T20:22:18.541Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTScloud, QuTS hero Problem Types: CWE-787 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.
.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-33
CVE ID: CVE-2021-34344 State: PUBLISHED Published: 2021-09-10T04:00:24.634958Z Last Updated: 2024-09-17T02:17:07.326Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QUSBCam2 Problem Types: CWE-787 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1
TS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-34
CVE ID: CVE-2021-34345 State: PUBLISHED Published: 2021-09-10T04:00:26.223988Z Last Updated: 2024-09-16T22:09:54.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: NVR Storage Expansion Problem Types: CWE-787 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qna
xpansion 1.0.6 ( 2021/08/03 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-36
CVE ID: CVE-2021-34346 State: PUBLISHED Published: 2021-09-10T04:00:27.734577Z Last Updated: 2024-09-16T20:17:13.055Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: NVR Storage Expansion Problem Types: CWE-787 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qna
CVE ID: CVE-2021-34348 State: PUBLISHED Published: 2021-09-27T00:45:21.425654Z Last Updated: 2024-09-16T22:21:18.959Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-35
CVE ID: CVE-2021-34349 State: PUBLISHED Published: 2021-09-27T00:45:23.028907Z Last Updated: 2024-09-17T00:56:42.411Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-35
CVE ID: CVE-2021-34351 State: PUBLISHED Published: 2021-09-27T00:45:24.485416Z Last Updated: 2024-09-16T22:45:09.320Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-35
CVE ID: CVE-2021-34352 State: PUBLISHED Published: 2021-10-01T02:50:14.803899Z Last Updated: 2024-09-17T00:01:13.681Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-38
CVE ID: CVE-2021-34354 State: PUBLISHED Published: 2021-10-01T02:50:16.306227Z Last Updated: 2024-09-17T03:53:47.488Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisor
01 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-41
CVE ID: CVE-2021-34355 State: PUBLISHED Published: 2021-10-01T02:50:17.806640Z Last Updated: 2024-09-16T22:24:56.305Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later Additional Analy
) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-42
CVE ID: CVE-2021-34356 State: PUBLISHED Published: 2021-10-01T02:50:19.306645Z Last Updated: 2024-09-16T16:52:47.065Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisor
CVE ID: CVE-2021-34357 State: PUBLISHED Published: 2021-11-13T00:50:10.221066Z Last Updated: 2024-09-17T02:15:40.656Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: QmailAgent Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-47
CVE ID: CVE-2021-34358 State: PUBLISHED Published: 2021-11-20T01:05:10.468356Z Last Updated: 2024-09-17T02:15:40.190Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: QNAP Systems Inc. Products: QmailAgent Problem Types: CWE-352 Description: We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 ( 2021/08/25 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-49
CVE ID: CVE-2021-34359 State: PUBLISHED Published: 2022-02-25T06:10:10.788122Z Last Updated: 2024-09-17T01:12:01.133Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Proxy Server Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security
2021/12/30 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-04
CVE ID: CVE-2021-34360 State: PUBLISHED Published: 2022-05-26T07:20:10.040731Z Last Updated: 2024-09-16T19:56:08.910Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: Proxy Server Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Ser
1.4.2 ( 2021/12/30 ) and later QuTS hero h5.0.0: Proxy Server 1.4.3 ( 2022/01/18 ) and later QuTScloud c4.5.6: Proxy Server 1.4.2 ( 2021/12/30 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-18