Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-2301 State: PUBLISHED Published: 2020-11-04T14:35:37 Last Updated: 2024-08-04T07:09:54.474Z Vendors: Jenkins project Products: Jenkins Active Directory Plugin Description: Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2123
CVE ID: CVE-2020-2302 State: PUBLISHED Published: 2020-11-04T14:35:37 Last Updated: 2024-08-04T07:09:53.296Z Vendors: Jenkins project Products: Jenkins Active Directory Plugin Description: A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1999
CVE ID: CVE-2020-2303 State: PUBLISHED Published: 2020-11-04T14:35:38 Last Updated: 2024-08-04T07:09:53.359Z Vendors: Jenkins project Products: Jenkins Active Directory Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2126 - http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE ID: CVE-2020-2304 State: PUBLISHED Published: 2020-11-04T14:35:38 Last Updated: 2024-08-04T07:09:53.361Z Vendors: Jenkins project Products: Jenkins Subversion Plugin Description: Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145 - http://www.openwall.com/lists/oss-security/2020/11/04/6
CVE ID: CVE-2020-2305 State: PUBLISHED Published: 2020-11-04T14:35:39 Last Updated: 2024-08-04T07:09:53.308Z Vendors: Jenkins project Products: Jenkins Mercurial Plugin Description: Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
CVE ID: CVE-2020-2306 State: PUBLISHED Published: 2020-11-04T14:35:39 Last Updated: 2024-08-04T07:09:53.307Z Vendors: Jenkins project Products: Jenkins Mercurial Plugin Description: A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
CVE ID: CVE-2020-2307 State: PUBLISHED Published: 2020-11-04T14:35:40 Last Updated: 2024-08-04T07:09:53.317Z Vendors: Jenkins project Products: Jenkins Kubernetes Plugin Description: Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646
CVE ID: CVE-2020-2308 State: PUBLISHED Published: 2020-11-04T14:35:40 Last Updated: 2024-08-04T07:09:54.588Z Vendors: Jenkins project Products: Jenkins Kubernetes Plugin Description: A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102
CVE ID: CVE-2020-2309 State: PUBLISHED Published: 2020-11-04T14:35:40 Last Updated: 2024-08-04T07:09:53.325Z Vendors: Jenkins project Products: Jenkins Kubernetes Plugin Description: A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103
CVE ID: CVE-2020-2310 State: PUBLISHED Published: 2020-11-04T14:35:41 Last Updated: 2024-08-04T07:09:53.340Z Vendors: Jenkins project Products: Jenkins Ansible Plugin Description: Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1943
CVE ID: CVE-2020-2311 State: PUBLISHED Published: 2020-11-04T14:35:41 Last Updated: 2024-08-04T07:09:53.309Z Vendors: Jenkins project Products: Jenkins AWS Global Configuration Plugin Description: A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2101
CVE ID: CVE-2020-2312 State: PUBLISHED Published: 2020-11-04T14:35:42 Last Updated: 2024-08-04T07:09:54.328Z Vendors: Jenkins project Products: Jenkins SQLPlus Script Runner Plugin Description: Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2129
CVE ID: CVE-2020-2313 State: PUBLISHED Published: 2020-11-04T14:35:42 Last Updated: 2024-08-04T07:09:54.272Z Vendors: Jenkins project Products: Jenkins Azure Key Vault Plugin Description: A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2110
CVE ID: CVE-2020-2314 State: PUBLISHED Published: 2020-11-04T14:35:43 Last Updated: 2024-08-04T07:09:54.158Z Vendors: Jenkins project Products: Jenkins AppSpider Plugin Description: Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2058
CVE ID: CVE-2020-2315 State: PUBLISHED Published: 2020-11-04T14:35:43 Last Updated: 2024-08-04T07:09:54.403Z Vendors: Jenkins project Products: Jenkins Visualworks Store Plugin Description: Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1900
CVE ID: CVE-2020-2316 State: PUBLISHED Published: 2020-11-04T14:35:44 Last Updated: 2024-08-04T07:09:54.329Z Vendors: Jenkins project Products: Jenkins Static Analysis Utilities Plugin Description: Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1907
CVE ID: CVE-2020-2317 State: PUBLISHED Published: 2020-11-04T14:35:44 Last Updated: 2024-08-04T07:09:54.233Z Vendors: Jenkins project Products: Jenkins FindBugs Plugin Description: Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1918
CVE ID: CVE-2020-2318 State: PUBLISHED Published: 2020-11-04T14:35:45 Last Updated: 2024-08-04T07:09:54.343Z Vendors: Jenkins project Products: Jenkins Mail Commander Plugin for Jenkins-ci Plugin Description: Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2085
CVE ID: CVE-2020-2319 State: PUBLISHED Published: 2020-11-04T14:35:45 Last Updated: 2024-08-04T07:09:54.620Z Vendors: Jenkins project Products: Jenkins VMware Lab Manager Slaves Plugin Description: Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2084
CVE ID: CVE-2020-2320 State: PUBLISHED Published: 2020-12-03T15:55:15 Last Updated: 2024-08-04T07:09:54.357Z Vendors: Jenkins project Products: Jenkins Plugin Installation Manager Tool Description: Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-1856 - http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE ID: CVE-2020-2321 State: PUBLISHED Published: 2020-12-03T15:55:15 Last Updated: 2024-08-04T07:09:54.337Z Vendors: Jenkins project Products: Jenkins Shelve Project Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2108 - http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE ID: CVE-2020-2322 State: PUBLISHED Published: 2020-12-03T15:55:15 Last Updated: 2024-08-04T07:09:54.492Z Vendors: Jenkins project Products: Jenkins Chaos Monkey Plugin Description: Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%281%29 - http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE ID: CVE-2020-2323 State: PUBLISHED Published: 2020-12-03T15:55:16 Last Updated: 2024-08-04T07:09:54.327Z Vendors: Jenkins project Products: Jenkins Chaos Monkey Plugin Description: Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2109%20%282%29 - http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE ID: CVE-2020-2324 State: PUBLISHED Published: 2020-12-03T15:55:16 Last Updated: 2024-08-04T07:09:54.374Z Vendors: Jenkins project Products: Jenkins CVS Plugin Description: Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146 - http://www.openwall.com/lists/oss-security/2020/12/03/2
CVE ID: CVE-2020-2490 State: PUBLISHED Published: 2020-11-16T00:56:21.109936Z Last Updated: 2024-09-16T19:51:29.911Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-77, CWE-78 Description: If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-09
CVE ID: CVE-2020-2491 State: PUBLISHED Published: 2020-12-10T03:34:06.628916Z Last Updated: 2024-09-17T00:56:10.939Z Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79, CWE-80 Description: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later Additional Analyst Notes: - CVE Program
4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-15
CVE ID: CVE-2020-2492 State: PUBLISHED Published: 2020-11-16T00:55:26.390029Z Last Updated: 2024-09-16T18:43:45.888Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-77, CWE-78 Description: If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-09
CVE ID: CVE-2020-2493 State: PUBLISHED Published: 2020-12-10T03:35:07.251969Z Last Updated: 2024-09-16T19:24:39.877Z Vendors: QNAP Systems Inc. Products: Multimedia Console Problem Types: CWE-79, CWE-80 Description: This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-14
CVE ID: CVE-2020-2494 State: PUBLISHED Published: 2020-12-10T03:36:27.203516Z Last Updated: 2024-09-17T00:40:59.501Z Vendors: QNAP Systems Inc. Products: Music Station Problem Types: CWE-79, CWE-80 Description: This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-13
CVE ID: CVE-2020-2495 State: PUBLISHED Published: 2020-12-10T03:39:04.077379Z Last Updated: 2024-09-16T23:26:14.829Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-79, CWE-80 Description: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 202006
0200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-12
CVE ID: CVE-2020-2496 State: PUBLISHED Published: 2020-12-10T03:41:39.475091Z Last Updated: 2024-09-17T02:20:35.583Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-79, CWE-80 Description: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 202006
CVE ID: CVE-2020-2497 State: PUBLISHED Published: 2020-12-10T03:43:11.879997Z Last Updated: 2024-09-16T23:27:03.580Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-79, CWE-80 Description: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 bu
33 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-12
CVE ID: CVE-2020-2498 State: PUBLISHED Published: 2020-12-10T03:45:19.398161Z Last Updated: 2024-09-16T20:12:28.817Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-79, CWE-80 Description: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6
.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-20-12
CVE ID: CVE-2020-2499 State: PUBLISHED Published: 2020-12-24T01:38:14.895132Z Last Updated: 2024-09-17T03:18:12.926Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N) Vendors: QNAP Systems Inc. Products: QES Problem Types: CWE-259, CWE-798, CWE-522 Description: A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-20-19
CVE ID: CVE-2020-2500 State: PUBLISHED Published: 2020-07-01T15:53:50 Last Updated: 2024-08-04T07:09:54.662Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Helpdesk Problem Types: CWE-284, CWE-321, CWE-798 Description: This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-a
d later versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-20-03
CVE ID: CVE-2020-2501 State: PUBLISHED Published: 2021-02-17T03:25:13.658920Z Last Updated: 2024-09-16T19:47:04.625Z Vendors: QNAP Systems Inc. Products: Surveillance Station Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Additional Analyst Notes: - C
llance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-07
CVE ID: CVE-2020-2502 State: PUBLISHED Published: 2021-02-17T03:25:14.261173Z Last Updated: 2024-09-16T23:06:30.137Z Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-79, CWE-80 Description: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-06
CVE ID: CVE-2020-2503 State: PUBLISHED Published: 2020-12-24T01:39:08.389271Z Last Updated: 2024-09-17T03:07:20.826Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QES Problem Types: CWE-79, CWE-80, CWE-749 Description: If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-20-17
CVE ID: CVE-2020-2504 State: PUBLISHED Published: 2020-12-24T01:39:28.422487Z Last Updated: 2024-09-17T00:25:31.081Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QES Problem Types: CWE-22, CWE-73, CWE-20, CWE-284 Description: If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-20-17
CVE ID: CVE-2020-2505 State: PUBLISHED Published: 2020-12-24T01:39:48.218705Z Last Updated: 2024-09-16T21:07:28.461Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QES Problem Types: CWE-209, CWE-755 Description: If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/qsa-20-17