rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-28791 
The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution upon opening the workspace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:06:15.000Z
CVE-2021-28792 
The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted sourcekit-lsp.serverPath, swift.languageServerPath, swift.path.sourcekite, swift.path.sourcekiteDockerMode, swift.path.swift_driver_bin, or swift.path.shell configuration value that triggers execution upon opening the workspace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:04:47.000Z
CVE-2021-28793 
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-20T12:36:04.000Z
CVE-2021-28794 
The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:05:15.000Z
CVE-2021-28796 
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-18T15:05:34.000Z
CVE-2021-28797 Stack Buffer Overflow in Surveillance Station
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: Surveillance Station
vendor: QNAP Systems Inc.
product: Surveillance Station
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-04-14T08:50:12.924Z
CVE-2021-28798 Relative Path Traversal Vulnerability in QTS and QuTS hero
A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ZUSO ART
Published: 2021-05-21T03:00:11.671Z
CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 2
vendor: QNAP Systems Inc.
product: HBS 1.3
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ZUSO ART
Published: 2021-05-13T02:55:13.827Z
CVE-2021-28800 Command Injection Vulnerability in QTS
A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504; versions prior to 4.3.3.1624 Build 20210416. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. QNAP Systems Inc. QuTS hero h4.5.3. QNAP Systems Inc. QuTScloud c4.5.5.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QuTScloud
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: CFF of Topsec Alpha Team
Published: 2021-06-24T06:20:11.049Z
CVE-2021-28801 Out-of-Bounds Read Vulnerability in QSS
An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read sensitive information on the system. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.2 build 20210122 on QSW-M2108-2C; versions prior to 1.0.2 build 20210122 on QSW-M2108-2S; versions prior to 1.0.2 build 20210122 on QSW-M2108R-2C.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: QNAP Systems Inc.
product: QSS
vendor: QNAP Systems Inc.
product: QSS
vendor: QNAP Systems Inc.
product: QSS
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Qian Chen from Codesafe Team of Legendsec at Qi'anxin Group
Published: 2021-06-11T06:35:14.369Z
CVE-2021-28802 Command Injection Vulnerabilities in QTS and QuTS hero
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
Credits: lang: en
value: Jan Hoff
Published: 2021-07-01T02:00:20.433Z
CVE-2021-28803 Stored XSS Vulnerability in Q'center
This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: Q'center
Credits: lang: en
value: Jan Hoff
Published: 2021-07-01T02:00:21.939Z
CVE-2021-28804 Command Injection Vulnerabilities in QTS and QuTS hero
A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
Credits: lang: en
value: Jan Hoff
Published: 2021-07-01T02:00:23.564Z
CVE-2021-28805 Inclusion of Sensitive Information in QSS
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.
Problem types: cwe_id: CWE-540
description: CWE-540 Information Exposure Through Source Code
Affected products: vendor: QNAP Systems Inc.
product: QSS
vendor: QNAP Systems Inc.
product: QSS
vendor: QNAP Systems Inc.
product: QSS
vendor: QNAP Systems Inc.
product: QSS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Jan Hoff
Published: 2021-06-11T06:35:15.074Z
CVE-2021-28806 DOM-Based XSS Vulnerability in QTS and QuTS hero
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QuTScloud
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Marcin Zięba
Published: 2021-06-03T02:45:13.325Z
CVE-2021-28807 Post-Authentication Reflected XSS Vulnerability in Q'center
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QNAP Systems Inc.
product: Q’center
vendor: QNAP Systems Inc.
product: Q’center
vendor: QNAP Systems Inc.
product: Q’center
vendor: QNAP Systems Inc.
product: Q’center
vendor: QNAP Systems Inc.
product: Q’center
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrea Cappa
Published: 2021-06-03T02:45:14.015Z
CVE-2021-28809 Missing Authentication for Critical Function in RTRR Server in HBS3
An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allows attackers to compromise the security of the operating system.QNAP have already fixed this vulnerability in the following versions of HBS 3: QTS 4.3.6: HBS 3 v3.0.210507 and later QTS 4.3.4: HBS 3 v3.0.210506 and later QTS 4.3.3: HBS 3 v3.0.210506 and later
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
vendor: QNAP Systems Inc.
product: HBS 3
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ta-Lun Yen of TXOne IoT/ICS Security Research Labs of Trend Micro working with Trend Micro’s Zero Day Initiative
Published: 2021-07-08T07:40:12.294Z
CVE-2021-28810 Vulnerability in Roon Server
If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Roon Labs
product: Roon Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Beijing Venustech Cybervision Co. Ltd
Published: 2021-06-08T03:00:12.833Z
CVE-2021-28811 Vulnerability in Roon Server
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Roon Labs
product: Roon Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Beijing Venustech Cybervision Co. Ltd
Published: 2021-06-08T03:00:13.487Z
CVE-2021-28812 Command Injection Vulnerability in Video Station
A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.
Problem types: cwe_id: CWE-1286
description: CWE-1286 Improper Validation of Syntactic Correctness of Input
cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: Video Station
vendor: QNAP Systems Inc.
product: Video Station
vendor: QNAP Systems Inc.
product: Video Station
vendor: QNAP Systems Inc.
product: Video Station
vendor: QNAP Systems Inc.
product: Video Station
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thomas Fady
Published: 2021-06-03T02:45:14.642Z
CVE-2021-28813 Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch
A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism.We have already fixed this vulnerability in the following versions: QSW-M2116P-2T2S 1.0.6 build 210713 and later QGD-1600P: QuNetSwitch 1.0.6.1509 and later QGD-1602P: QuNetSwitch 1.0.6.1509 and later QGD-3014PT: QuNetSwitch 1.0.6.1519 and later
Problem types: cwe_id: CWE-259
description: CWE-259
cwe_id: CWE-798
description: CWE-798
cwe_id: CWE-522
description: CWE-522
Affected products: vendor: QNAP Systems Inc.
product: QSW-M2116P-2T2S
vendor: QNAP Systems Inc.
product: QuNetSwitch
vendor: QNAP Systems Inc.
product: QuNetSwitch
vendor: QNAP Systems Inc.
product: QuNetSwitch
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2021-09-10T04:00:20.068Z
CVE-2021-28814 Improper Access Control Vulnerability in Helpdesk
An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: QNAP Systems Inc.
product: Helpdesk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thomas FADY
Published: 2021-06-11T06:35:15.709Z
CVE-2021-28815 Insecure Storage of Sensitive Information in myQNAPcloud Link
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link versions prior to 2.2.21 on QTS 4.5.3; versions prior to 2.2.21 on QuTS hero h4.5.2; versions prior to 2.2.21 on QuTScloud c4.5.4.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
Affected products: vendor: QNAP Systems Inc.
product: myQNAPcloud Link
vendor: QNAP Systems Inc.
product: myQNAPcloud Link
vendor: QNAP Systems Inc.
product: myQNAPcloud Link
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: CJ Fairhead
Published: 2021-06-16T04:00:11.639Z
CVE-2021-28816 Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud
A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QTS, QuTScloud, QuTS hero: QTS 4.5.4.1715 build 20210630 and later QTS 5.0.0.1716 build 20210701 and later QTS 4.3.3.1693 build 20210624 and later QTS 4.3.6.1750 build 20210730 and later QuTScloud c4.5.6.1755 and later QuTS hero h4.5.4.1771 build 20210825 and later
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTScloud
vendor: QNAP Systems Inc.
product: QuTS hero
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Bingwei Peng of VARAS@IIE
Published: 2021-09-10T04:00:21.577Z
CVE-2021-28817 TIBCO Rendezvous Windows Platform Installation vulnerability
The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions 8.5.1 and below and TIBCO Rendezvous Developer Edition: versions 8.5.1 and below.
Problem types: description: The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Rendezvous
vendor: TIBCO Software Inc.
product: TIBCO Rendezvous Developer Edition
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
Published: 2021-03-23T20:15:21.477Z