rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-14663 
An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: [UNKNOWN]
product: dnsdist
Published: 2018-11-26T22:00:00.000Z
CVE-2018-14664 
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: [UNKNOWN]
product: foreman
Published: 2018-10-12T20:00:00.000Z
CVE-2018-14665 
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-25T20:00:00.000Z
CVE-2018-14666 
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: [UNKNOWN]
product: Satellite
Published: 2019-01-22T15:00:00.000Z
CVE-2018-14667 
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: [UNKNOWN]
product: RichFaces
Published: 2018-11-06T22:00:00.000Z
CVE-2018-14668 
In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.
Problem types: description: Cross Protocol Request Forgery
Affected products: vendor: n/a
product: ClickHouse
Published: 2019-08-15T17:31:24.000Z
CVE-2018-14669 
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.
Problem types: description: Local File Disclosure
Affected products: vendor: n/a
product: ClickHouse
Published: 2019-08-15T17:39:30.000Z
CVE-2018-14670 
Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
Problem types: description: Execution with Unnecessary Privileges
Affected products: vendor: ClickHouse
product: ClickHouse
Published: 2019-08-15T17:13:39.000Z
CVE-2018-14671 
In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
Problem types: description: Remote Code Execution
Affected products: vendor: ClickHouse
product: ClickHouse
Published: 2019-08-15T17:46:03.000Z
CVE-2018-14672 
In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: ClickHouse
Published: 2019-08-15T17:54:05.000Z
CVE-2018-14678 
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T18:00:00.000Z
CVE-2018-14679 
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14680 
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14681 
An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14682 
An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14683 
PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-10T21:32:32.000Z
CVE-2018-14685 
The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14686 
system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request, related to add_book.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-28T23:00:00.000Z
CVE-2018-14688 
An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the name[x], streamUrl[x], homepageUrl[x] parameters (where x is an integer) to internetRadioSettings.view that could be used to steal session information of a victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-14689 
An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the name[x], sourceformats[x], targetFormat[x], step1[x], and step2[x] parameters (where x is an integer) to transcodingSettings.view that could be used to steal session information of a victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-14690 
An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-14691 
An issue was discovered in Subsonic 6.1.1. The music tags feature is affected by three stored cross-site scripting vulnerabilities in the c0-param2, c0-param3, and c0-param4 parameters to dwr/call/plaincall/tagService.setTags.dwr that could be used to steal session information of a victim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T16:00:00.000Z
CVE-2018-14695 
Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14696 
Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14697 
Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14698 
Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14699 
System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14700 
Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14701 
System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14702 
Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14703 
Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14704 
Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14705 Lack of Authentication/Authorization on Administrative Web Pages
In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:16:20.000Z
CVE-2018-14706 
System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14707 
Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14708 
An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14709 
Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-03T22:00:00.000Z
CVE-2018-14710 
Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:19:24.000Z
CVE-2018-14711 
Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with specially crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:20:19.000Z
CVE-2018-14712 
Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:21:11.000Z
CVE-2018-14713 
Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers via the "hook" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:22:09.000Z
CVE-2018-14714 
System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T12:24:24.000Z
CVE-2018-14715 
The endCoinFlip function and throwSlammer function of the smart contract implementations for Cryptogs, an Ethereum game, generate random numbers with an old block's hash. Therefore, attackers can predict the random number and always win the game.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T18:00:00.000Z
CVE-2018-14716 
A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-06T20:00:00.000Z
CVE-2018-14718 
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-14719 
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-14720 
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-14721 
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-02T18:00:00.000Z
CVE-2018-14722 
An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-{scrub,balance,trim} are set to auto in /etc/sysconfig/btrfsmaintenance (this is not the default, though).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-15T18:00:00.000Z
CVE-2018-14724 
In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the ban reason, which is executed on the bans.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-18T19:30:29.000Z
CVE-2018-14728 
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-03T18:00:00.000Z
CVE-2018-14729 
The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T17:54:38.000Z
CVE-2018-14730 
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-14731 
An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1 connection (with a random TCP port number) from any origin. The random port number can be found by connecting to http://127.0.0.1 and reading the "new WebSocket" line in the source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-14732 
An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T17:00:00.000Z
CVE-2018-14733 
The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under certain circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-05T19:54:55.000Z
CVE-2018-14734 
drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T16:00:00.000Z
CVE-2018-14735 
An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. A remote attacker may be able to exploit a flaw in the permission of messaging that may allow for information exposure via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-09T20:00:00.000Z
CVE-2018-14736 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A buffer over-read can occur in pbc_wmessage_string in wmessage.c for PTYPE_ENUM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14737 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A NULL pointer dereference can occur in pbc_wmessage_string in wmessage.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14738 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_rmessage_message in rmessage.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14739 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_set_default in pattern.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14740 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c while making a query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14741 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbc_pattern_pack in pattern.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14742 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in set_field_one in bootstrap.c during a memcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14743 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in wiretype_decode in context.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14744 
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A use-after-free can occur in _pbcM_sp_query in map.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-29T18:00:00.000Z
CVE-2018-14745 
Buffer overflow in prot_get_ring_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to overwrite kernel memory due to improper validation of the ring buffer read pointer. The Samsung ID is SVE-2018-12029.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-15T22:00:00.000Z
CVE-2018-14746 
Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS.
Problem types: description: Command Injection
Affected products: vendor: QNAP
product: QNAP QTS
Published: 2018-11-28T16:00:00.000Z
CVE-2018-14747 
NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server.
Problem types: description: NULL Pointer Dereference
Affected products: vendor: QNAP
product: QNAP QTS
Published: 2018-11-28T16:00:00.000Z