Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714) Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-392
-28714) Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-392.txt - https://www.debian.org/security/2022/dsa-5050 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-28715 State: PUBLISHED Published: 2022-01-06T17:06:05.000Z Last Updated: 2025-05-22T18:34:45.221Z Vendors: Linux Products: Linux Problem Types: unknown Description: Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming
but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.x
-2021-28714) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-392.txt - https://www.debian.org/security/2022/dsa-5050 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2021-28732 State: REJECTED Published: 2021-09-08T16:23:40 Last Updated: 2021-09-08T16:59:18 Description: No description available.
CVE ID: CVE-2021-28789 State: PUBLISHED Published: 2021-03-18T15:05:52 Last Updated: 2024-08-03T21:55:11.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted apple-swift-format.path configuration value that triggers execution upon opening the workspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vknabel/vscode-apple-swift-format/releases/tag/1.1.2 - https://vuln.ryotak.me/advisories/11
CVE ID: CVE-2021-28790 State: PUBLISHED Published: 2021-03-18T15:04:29 Last Updated: 2024-08-03T21:55:11.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftlint.path configuration value that triggers execution upon opening the workspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vknabel/vscode-swiftlint/releases/tag/1.4.5 - https://vuln.ryotak.me/advisories/12
CVE ID: CVE-2021-28791 State: PUBLISHED Published: 2021-03-18T15:06:15 Last Updated: 2024-08-03T21:55:11.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution upon opening the workspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vknabel/vscode-swiftformat/releases/tag/1.3.7 - https://vuln.ryotak.me/advisories/13
CVE ID: CVE-2021-28792 State: PUBLISHED Published: 2021-03-18T15:04:47 Last Updated: 2024-08-03T21:55:11.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted sourcekit-lsp.serverPath, swift.languageServerPath, swift.path.sourcekite, swift.path.sourcekiteDockerMode, swift.path.swift_driver_bin, or swift.path.shell configuration value that triggers execution upon opening the workspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vknabel/vscode-swift-de
e workspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vknabel/vscode-swift-development-environment/releases/tag/2.12.1 - https://vuln.ryotak.me/advisories/14
CVE ID: CVE-2021-28793 State: PUBLISHED Published: 2021-04-20T12:36:04 Last Updated: 2024-08-03T21:55:11.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases - https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0 - https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418
tag/147.0.0 - https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418b208c5af - https://vuln.ryotak.me/advisories/37
CVE ID: CVE-2021-28794 State: PUBLISHED Published: 2021-03-18T15:05:15 Last Updated: 2024-08-03T21:55:11.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/timonwong/vscode-shellcheck/pull/181 - https://github.com/timonwong/vscode-shellcheck/releases/tag/v0.13.4 - https://vuln.ryotak.me/advisories/10
CVE ID: CVE-2021-28796 State: PUBLISHED Published: 2021-03-18T15:05:34 Last Updated: 2024-08-03T21:55:11.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/increments/qiita-markdown/compare/v0.32.0...v0.33.0 - https://vuln.ryotak.me/advisories/15
CVE ID: CVE-2021-28797 State: PUBLISHED Published: 2021-04-14T08:50:12.924773Z Last Updated: 2024-09-17T03:28:54.883Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Surveillance Station Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM
4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-07
CVE ID: CVE-2021-28798 State: PUBLISHED Published: 2021-05-21T03:00:11.671026Z Last Updated: 2024-09-16T18:49:25.069Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-284, CWE-23 Description: A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Bui
0406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-14
CVE ID: CVE-2021-28799 State: PUBLISHED Published: 2021-05-13T02:55:13.827Z Last Updated: 2025-10-21T23:25:45.551Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: HBS 3, HBS 2, HBS 1.3 Problem Types: CWE-285 Description: An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; vers
o v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/QSA-21-13
CVE ID: CVE-2021-28800 State: PUBLISHED Published: 2021-06-24T06:20:11.049284Z Last Updated: 2024-09-16T23:01:07.180Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP System
10504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-28
CVE ID: CVE-2021-28801 State: PUBLISHED Published: 2021-06-11T06:35:14.369676Z Last Updated: 2024-09-17T00:06:25.170Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QSS Problem Types: CWE-125 Description: An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read sensitive information on the system. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.2 build 20210122 on QSW-M2108-2C; versions prior to 1.0.2 build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C. Additional Analyst Notes: - CV
build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-23
CVE ID: CVE-2021-28802 State: PUBLISHED Published: 2021-07-01T02:00:20.433835Z Last Updated: 2024-09-16T22:15:54.877Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-29
CVE ID: CVE-2021-28803 State: PUBLISHED Published: 2021-07-01T02:00:21.939413Z Last Updated: 2024-09-16T17:34:26.707Z Vendors: QNAP Systems Inc. Products: Q'center Problem Types: CWE-80 Description: This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-31
CVE ID: CVE-2021-28804 State: PUBLISHED Published: 2021-07-01T02:00:23.564098Z Last Updated: 2024-09-16T16:54:06.578Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-29
CVE ID: CVE-2021-28805 State: PUBLISHED Published: 2021-06-11T06:35:15.074830Z Last Updated: 2024-09-17T04:19:06.268Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QSS Problem Types: CWE-540 Description: Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build
build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-24
CVE ID: CVE-2021-28806 State: PUBLISHED Published: 2021-06-03T02:45:13.325672Z Last Updated: 2024-09-16T22:55:32.202Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-79 Description: A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This i
ns prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-22
CVE ID: CVE-2021-28807 State: PUBLISHED Published: 2021-06-03T02:45:14.015221Z Last Updated: 2024-09-16T17:17:48.672Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: Q’center Problem Types: CWE-79 Description: A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012
QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-20 - https://www.shielder.it/advisories/qnap-qcenter-virtual-stored-xss/ - https://www.shielder.it/advisories/qnap-qcenter-post-auth-remote-code-execution-via-qpkg/
CVE ID: CVE-2021-28809 State: PUBLISHED Published: 2021-07-08T07:40:12.294698Z Last Updated: 2024-09-17T00:36:54.377Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: HBS 3 Problem Types: CWE-284, CWE-306, CWE-749 Description: An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later Additional
.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-19 - https://www.zerodayinitiative.com/advisories/ZDI-21-783/
CVE ID: CVE-2021-28810 State: PUBLISHED Published: 2021-06-08T03:00:12.833507Z Last Updated: 2024-09-16T19:57:30.575Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Roon Labs Products: Roon Server Problem Types: CWE-290 Description: If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-17
CVE ID: CVE-2021-28811 State: PUBLISHED Published: 2021-06-08T03:00:13.487690Z Last Updated: 2024-09-16T22:15:50.049Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Roon Labs Products: Roon Server Problem Types: CWE-78 Description: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-17
CVE ID: CVE-2021-28812 State: PUBLISHED Published: 2021-06-03T02:45:14.642723Z Last Updated: 2024-09-16T20:11:39.918Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Video Station Problem Types: CWE-1286, CWE-77, CWE-78 Description: A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems I
or to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-21
CVE ID: CVE-2021-28813 State: PUBLISHED Published: 2021-09-10T04:00:20.068065Z Last Updated: 2024-09-17T00:21:02.142Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: QNAP Systems Inc. Products: QSW-M2116P-2T2S, QuNetSwitch Problem Types: CWE-259, CWE-798, CWE-522 Description: A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 21071
storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-37
CVE ID: CVE-2021-28814 State: PUBLISHED Published: 2021-06-11T06:35:15.709685Z Last Updated: 2024-09-17T03:58:40.524Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Helpdesk Problem Types: CWE-269 Description: An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-25
CVE ID: CVE-2021-28815 State: PUBLISHED Published: 2021-06-16T04:00:11.639822Z Last Updated: 2024-09-17T01:16:56.461Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: myQNAPcloud Link Problem Types: CWE-922 Description: Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4
ons prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-21-26
CVE ID: CVE-2021-28816 State: PUBLISHED Published: 2021-09-10T04:00:21.577967Z Last Updated: 2024-09-17T01:56:02.590Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTScloud, QuTS hero Problem Types: CWE-787 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4
.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-33