Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
al operations to the transmitter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02
CVE ID: CVE-2024-21875 State: PUBLISHED Published: 2024-02-11T08:37:10.098Z Last Updated: 2025-03-11T13:38:38.893Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Badge.team Products: Hacker Hotel Badge 2024 Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 2024 on risc-v (billboard modules) allows Flooding.This issue affects Hacker Hotel Badge 2024: from 0.1.0 through 0.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/CVE-2024-21875 - https://github.com/badgeteam/hacke
chment: - CVE Program Container: References: - https://csirt.divd.nl/CVE-2024-21875 - https://github.com/badgeteam/hackerhotel-2024-firmware-esp32c6/pull/64
CVE ID: CVE-2024-21876 State: PUBLISHED Published: 2024-08-10T17:44:50.205Z Last Updated: 2025-03-11T13:38:30.594Z Vendors: Enphase Products: IQ Gateway Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21876 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-1
CVE ID: CVE-2024-21877 State: PUBLISHED Published: 2024-08-10T17:44:49.284Z Last Updated: 2025-03-11T13:38:26.399Z Vendors: Enphase Products: Envoy Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and < 8.2.4225. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21877 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-2
CVE ID: CVE-2024-21878 State: PUBLISHED Published: 2024-08-10T17:44:48.892Z Last Updated: 2025-03-11T13:38:31.973Z Vendors: Enphase Products: Envoy Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4.x up to and including 8.x and is currently unpatched. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21878 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-3
CVE ID: CVE-2024-21879 State: PUBLISHED Published: 2024-08-10T17:44:49.728Z Last Updated: 2025-03-11T13:38:27.809Z Vendors: Enphase Products: Envoy Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4.x to 8.x and < 8.2.4225. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21879 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-4
CVE ID: CVE-2024-21880 State: PUBLISHED Published: 2024-08-10T17:44:48.465Z Last Updated: 2025-03-11T13:38:29.210Z Vendors: Enphase Products: Envoy Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= 7.x Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21880 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-5
CVE ID: CVE-2024-21881 State: PUBLISHED Published: 2024-08-10T17:44:48.033Z Last Updated: 2025-03-11T13:38:24.981Z Vendors: Enphase Products: Envoy Problem Types: CWE-326 Description: Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2024-21881 - https://csirt.divd.nl/DIVD-2024-00011 - https://enphase.com/cybersecurity/advisories/ensa-2024-6
CVE ID: CVE-2024-21885 State: PUBLISHED Published: 2024-02-28T12:11:59.650Z Last Updated: 2025-11-06T20:53:28.030Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services fo
Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-122 Description: A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which
ertain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0320 - https://access.redhat.com/errata/RHSA-2024:0557 - https://access.redhat.com/errata/RHSA-2024:0558 - https://access.redhat.com/errata/RHSA-2024:0597 - https://access.redhat.com/errata/RHSA-2024:0607 - https://access.redhat.com/errata/RHSA-2024:0614 - https://access.redhat.com/errata/RHSA-2024:0617 - https://access.redhat.com/errata/RHSA-2024:06
/errata/RHSA-2024:0614 - https://access.redhat.com/errata/RHSA-2024:0617 - https://access.redhat.com/errata/RHSA-2024:0621 - https://access.redhat.com/errata/RHSA-2024:0626 - https://access.redhat.com/errata/RHSA-2024:0629 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/errata/RHSA-2025:12751 - https://access.redhat.com/security/cve/CVE-2024-21885 - https://bugzilla.redhat.com/show_bug.cgi?id=2256540
CVE ID: CVE-2024-21886 State: PUBLISHED Published: 2024-02-28T12:13:12.555Z Last Updated: 2025-11-06T20:53:28.237Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services fo
Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-122 Description: A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments. Additional Analyst Notes: - CISA ADP V
in some circumstances, remote code execution in SSH X11 forwarding environments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0320 - https://access.redhat.com/errata/RHSA-2024:0557 - https://access.redhat.com/errata/RHSA-2024:0558 - https://access.redhat.com/errata/RHSA-2024:0597 - https://access.redhat.com/errata/RHSA-2024:0607 - https://access.redhat.com/errata/RHSA-2024:0614 - https://access.redhat.com/errata/RHSA-2024:0617 - https://access.redhat.com/errata/RHSA-2024:0621 - https://access.redhat.com/errata/RHSA-2024:0626 - https://access.redhat.com/errata/RHSA-2024:0629 - https://access.redhat.com/er
access.redhat.com/errata/RHSA-2024:0626 - https://access.redhat.com/errata/RHSA-2024:0629 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/errata/RHSA-2025:12751 - https://access.redhat.com/security/cve/CVE-2024-21886 - https://bugzilla.redhat.com/show_bug.cgi?id=2256542
CVE ID: CVE-2024-21887 State: PUBLISHED Published: 2024-01-12T17:02:16.481Z Last Updated: 2025-10-21T23:05:28.696Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: ICS, IPS Description: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect
s://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US - http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2024-21888 State: PUBLISHED Published: 2024-01-31T17:51:34.941Z Last Updated: 2025-06-03T18:46:20.638Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: ICS, IPS Description: A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
CVE ID: CVE-2024-21890 State: PUBLISHED Published: 2024-02-20T01:31:08.153Z Last Updated: 2025-04-30T22:25:10.724Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NodeJS Products: Node Description: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental
in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2257156 - https://security.netapp.com/advisory/ntap-20240315-0002/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-21891 State: PUBLISHED Published: 2024-02-20T01:31:08.152Z Last Updated: 2025-04-30T22:25:09.844Z Severity: HIGH (CVSS 7.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: NodeJS Products: Node Description: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional An
ase note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2259914 - https://security.netapp.com/advisory/ntap-20240315-0005/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-21892 State: PUBLISHED Published: 2024-02-20T01:31:08.073Z Last Updated: 2025-04-30T22:25:11.607Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: NodeJS Products: Node Description: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges. Additional Analy
een set. This allows unprivileged users to inject code that inherits the process's elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2237545 - https://security.netapp.com/advisory/ntap-20240322-0003/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-21893 State: PUBLISHED Published: 2024-01-31T17:51:35.095Z Last Updated: 2025-10-21T23:05:25.541Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Ivanti Products: ICS, IPS Description: A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?lang
/forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
CVE ID: CVE-2024-21894 State: PUBLISHED Published: 2024-04-04T22:16:29.330Z Last Updated: 2024-10-03T21:43:40.315Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-CV
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVE ID: CVE-2024-21896 State: PUBLISHED Published: 2024-02-20T01:31:08.176Z Last Updated: 2025-04-30T22:25:13.375Z Severity: HIGH (CVSS 7.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:M/IR:M/AR:M) Vendors: NodeJS Products: Node Description: The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability
e application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2218653 - https://security.netapp.com/advisory/ntap-20240329-0002/ - http://www.openwall.com/lists/oss-security/2024/03/11/1
CVE ID: CVE-2024-21897 State: PUBLISHED Published: 2024-09-06T16:26:19.971Z Last Updated: 2024-09-06T17:34:27.664Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
0402 and later QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-20
CVE ID: CVE-2024-21898 State: PUBLISHED Published: 2024-09-06T16:26:24.271Z Last Updated: 2024-09-06T17:43:29.571Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ater QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-20
CVE ID: CVE-2024-21899 State: PUBLISHED Published: 2024-03-08T16:17:25.243Z Last Updated: 2024-08-01T22:35:34.557Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later Qu
.2578 build 20231110 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09
CVE ID: CVE-2024-21900 State: PUBLISHED Published: 2024-03-08T16:17:29.628Z Last Updated: 2024-08-01T22:35:34.489Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-74 Description: An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA A
later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09
CVE ID: CVE-2024-21901 State: PUBLISHED Published: 2024-03-08T16:17:34.753Z Last Updated: 2024-08-01T22:35:34.478Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: myQNAPcloud, QTS Problem Types: CWE-89 Description: A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 ) and later QTS 4.5.4.2627 build 20231225 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
4.2627 build 20231225 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-09
CVE ID: CVE-2024-21902 State: PUBLISHED Published: 2024-05-21T16:08:14.291Z Last Updated: 2024-08-01T22:35:33.414Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-732, CWE-200 Description: An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later Additional An
following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-24-23
CVE ID: CVE-2024-21903 State: PUBLISHED Published: 2024-09-06T16:26:27.970Z Last Updated: 2024-09-06T17:27:44.415Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-77, CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later Additional Analyst Notes: - CISA ADP Vulnrichment