rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-38648 Open Management Infrastructure Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Open Management Infrastructure
cpes: cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
vendor: Microsoft
product: System Center Operations Manager (SCOM)
cpes: cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Automation State Configuration, DSC Extension
cpes: cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Automation Update Management
cpes: cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Log Analytics Agent
cpes: cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Diagnostics (LAD)
cpes: cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Container Monitoring Solution
cpes: cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Security Center
cpes: cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Sentinel
cpes: cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Stack Hub
cpes: cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:08.000Z
CVE-2021-38649 Open Management Infrastructure Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Open Management Infrastructure
cpes: cpe:2.3:a:microsoft:open_management_infrastructure:*:*:*:*:*:*:*:*
vendor: Microsoft
product: System Center Operations Manager (SCOM)
cpes: cpe:2.3:a:microsoft:system_center_operations_manager:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Automation State Configuration, DSC Extension
cpes: cpe:2.3:a:microsoft:azure_automation_state_configuration:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Automation Update Management
cpes: cpe:2.3:a:microsoft:azure_automation_update_management:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Log Analytics Agent
cpes: cpe:2.3:a:microsoft:log_analytics_agent:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Diagnostics (LAD)
cpes: cpe:2.3:a:microsoft:azure_diagnostics:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Container Monitoring Solution
cpes: cpe:2.3:a:microsoft:container_monitoring_solution:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Security Center
cpes: cpe:2.3:a:microsoft:azure_security_center:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Sentinel
cpes: cpe:2.3:a:microsoft:azure_sentinel:*:*:*:*:*:*:*:*
vendor: Microsoft
product: Azure Stack Hub
cpes: cpe:2.3:a:microsoft:azure_stack_hub:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:09.000Z
CVE-2021-38650 Microsoft Office Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Office 2019 for Mac
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*
vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft Office 2016
cpes: cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
vendor: Microsoft
product: Microsoft Office 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:10.000Z
CVE-2021-38651 Microsoft SharePoint Server Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
cpes: cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Server 2019
cpes: cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Foundation 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:10.000Z
CVE-2021-38652 Microsoft SharePoint Server Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
cpes: cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft SharePoint Foundation 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:11.000Z
CVE-2021-38653 Microsoft Office Visio Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:12.000Z
CVE-2021-38654 Microsoft Office Visio Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:13.000Z
CVE-2021-38655 Microsoft Excel Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Office 2019 for Mac
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*
vendor: Microsoft
product: Microsoft Office Online Server
cpes: cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
vendor: Microsoft
product: Microsoft Excel 2016
cpes: cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:x64:*
vendor: Microsoft
product: Microsoft Excel 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:x64:*
vendor: Microsoft
product: Microsoft Office Web Apps Server 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:14.000Z
CVE-2021-38656 Microsoft Word Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:15.000Z
CVE-2021-38657 Microsoft Office Graphics Component Information Disclosure Vulnerability
Problem types: description: Information Disclosure
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:17.000Z
CVE-2021-38658 Microsoft Office Graphics Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Office 2019
cpes: cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
vendor: Microsoft
product: Microsoft Office 2016
cpes: cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
vendor: Microsoft
product: Microsoft Office 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:18.000Z
CVE-2021-38659 Microsoft Office Graphics Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
cpes: cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:19.000Z
CVE-2021-38660 Microsoft Office Graphics Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Excel 2013 Service Pack 1
cpes: cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:x86:*
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:20.000Z
CVE-2021-38661 HEVC Video Extensions Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: HEVC Video Extensions
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:21.000Z
CVE-2021-38669 Microsoft Edge (Chromium-based) Tampering Vulnerability
Problem types: description: Tampering
Affected products: vendor: Microsoft
product: Microsoft Edge (Chromium-based)
cpes: cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C
Published: 2021-09-15T11:24:23.000Z
CVE-2021-38672 Windows Hyper-V Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows Server 2022
cpes: cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.288:*:*:*:*:*:*:*
vendor: Microsoft
product: Windows 11 version 21H2
cpes: cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.258:*:*:*:*:*:x64:*
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2021-10-13T00:26:44.000Z
CVE-2021-38674 Reflected XSS Vulnerability in TFTP
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTScloud
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Tony Martin, a security researcher
Published: 2022-01-07T01:15:12.605Z
CVE-2021-38675 Stored XSS Vulnerability in Image2PDF
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: QNAP Systems Inc.
product: Image2PDF
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Tony Martin, a security researcher
Published: 2021-10-01T02:50:20.876Z
CVE-2021-38677 Reflected XSS Vulnerability in QcalAgent
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: QNAP Systems Inc.
product: QcalAgent
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Tony Martin, a security researcher
Published: 2022-01-14T01:00:16.519Z
CVE-2021-38678 Open Redirect Vulnerability in QcalAgent
An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: QNAP Systems Inc.
product: QcalAgent
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Tony Martin, a security researcher
Published: 2022-01-14T01:00:17.962Z
CVE-2021-38679 Improper Authentication in Kazoo Server
An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.22 and later
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: QNAP Systems Inc.
product: Kazoo Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: XUELIANG SUN
Published: 2022-02-11T13:20:11.061Z
CVE-2021-38680 Reflected XSS in Kazoo Server
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Linn Products Limited
product: Kazoo Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: XUELIANG SUN
Published: 2021-12-29T13:05:13.324Z
CVE-2021-38681 Reflected XSS Vulnerability in Ragic Cloud DB
A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security patch from Ragic.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Negocios
product: Ragic Cloud DB
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2021-11-20T01:05:12.456Z
CVE-2021-38682 Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard
A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 and later QTS 5.0.0: QVR Guard 2.1.3.0 and later
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Elite
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Pro
vendor: QNAP Systems Inc.
product: QVR Guard
vendor: QNAP Systems Inc.
product: QVR Guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2022-01-14T01:00:19.308Z
CVE-2021-38684 Buffer Overflow Vulnerability in Multimedia Console
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedia Console: Multimedia Console 1.4.3 ( 2021/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: QNAP Systems Inc.
product: Multimedia Console
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2021-11-13T00:50:11.720Z
CVE-2021-38685 Command Injection Vulnerability in VioStor
A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: QVR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: JPCERT/CC
Published: 2021-11-26T14:00:13.130Z
CVE-2021-38686 Improper Authentication Vulnerability in VioStor
An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: QNAP Systems Inc.
product: QVR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: JPCERT/CC
Published: 2021-11-26T14:00:14.527Z
CVE-2021-38687 Stack Overflow Vulnerability in Surveillance Station
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: QNAP Systems Inc.
product: Surveillance Station
vendor: QNAP Systems Inc.
product: Surveillance Station
vendor: QNAP Systems Inc.
product: Surveillance Station
vendor: QNAP Systems Inc.
product: Surveillance Station
vendor: QNAP Systems Inc.
product: Surveillance Station
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: crixer
Published: 2021-12-29T13:05:14.828Z