stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-38547 (severity: MEDIUM, weakness: NVD-CWE-Other)
Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
CVE-2021-38548 (severity: MEDIUM, weakness: NVD-CWE-Other)
JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
CVE-2021-38549 (severity: MEDIUM, weakness: NVD-CWE-Other)
MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers.
CVE-2021-3855 (severity: HIGH, weakness: CWE-77)
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462.
CVE-2021-38553 (severity: MEDIUM, weakness: CWE-281)
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
CVE-2021-38554 (severity: MEDIUM, weakness: CWE-212)
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
CVE-2021-38555 (severity: CRITICAL, weakness: CWE-611)
An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
CVE-2021-38556 (severity: HIGH, weakness: CWE-77)
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
CVE-2021-38557 (severity: HIGH, weakness: CWE-732)
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
CVE-2021-38559 (severity: MEDIUM, weakness: CWE-79)
DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
CVE-2021-3856 (severity: MEDIUM, weakness: CWE-552)
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
CVE-2021-38560 (severity: MEDIUM, weakness: CWE-79)
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.
CVE-2021-38561 (severity: HIGH, weakness: CWE-125)
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
CVE-2021-38562 (severity: HIGH, weakness: CWE-203)
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
CVE-2021-38563 (severity: CRITICAL, weakness: CWE-129)
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write).
CVE-2021-38564 (severity: CRITICAL, weakness: CWE-125)
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.
CVE-2021-38565 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm.
CVE-2021-38566 (severity: HIGH, weakness: CWE-674)
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.
CVE-2021-38567 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204.
CVE-2021-38568 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.
CVE-2021-38569 (severity: HIGH, weakness: CWE-674)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.
CVE-2021-3857 (severity: HIGH, weakness: CWE-79)
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-38570 (severity: CRITICAL, weakness: CWE-59)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
CVE-2021-38571 (severity: HIGH, weakness: CWE-427)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.
CVE-2021-38572 (severity: CRITICAL, weakness: NVD-CWE-Other)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.
CVE-2021-38573 (severity: CRITICAL, weakness: NVD-CWE-Other)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.
CVE-2021-38574 (severity: CRITICAL, weakness: CWE-89)
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.
CVE-2021-38575 (severity: HIGH, weakness: CWE-124)
NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.
CVE-2021-38576 (severity: HIGH, weakness: NVD-CWE-Other)
A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.
CVE-2021-38578 (severity: CRITICAL, weakness: CWE-124)
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.
CVE-2021-3858 (severity: MEDIUM, weakness: CWE-352)
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-38583 (severity: MEDIUM, weakness: CWE-79)
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).
CVE-2021-38584 (severity: HIGH, weakness: CWE-611)
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVE-2021-38585 (severity: HIGH, weakness: CWE-502)
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVE-2021-38586 (severity: MEDIUM, weakness: NVD-CWE-Other)
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVE-2021-38587 (severity: HIGH, weakness: CWE-362)
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVE-2021-38588 (severity: HIGH, weakness: CWE-494)
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVE-2021-38589 (severity: HIGH, weakness: NVD-CWE-Other)
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
CVE-2021-3859 (severity: HIGH, weakness: CWE-214)
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
CVE-2021-38590 (severity: MEDIUM, weakness: CWE-732)
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
CVE-2021-38591 (severity: LOW, weakness: NVD-CWE-Other)
An issue was discovered on LG mobile devices with Android OS P and Q software for mt6762/mt6765/mt6883. Attackers can change some of the NvRAM content by leveraging the misconfiguration of a debug command. The LG ID is LVE-SMP-210005 (August 2021).
CVE-2021-38592 (severity: HIGH, weakness: CWE-787)
Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).
CVE-2021-38593 (severity: HIGH, weakness: CWE-787)
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
CVE-2021-38597 (severity: MEDIUM, weakness: CWE-345)
wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension.
CVE-2021-38598 (severity: CRITICAL, weakness: CWE-290)
OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.
CVE-2021-38599 (severity: HIGH, weakness: CWE-754)
WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
CVE-2021-3860 (severity: HIGH, weakness: CWE-89)
JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.
CVE-2021-38602 (severity: MEDIUM, weakness: CWE-79)
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
CVE-2021-38603 (severity: MEDIUM, weakness: CWE-79)
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
CVE-2021-38604 (severity: HIGH, weakness: CWE-476)
In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.
CVE-2021-38606 (severity: CRITICAL, weakness: CWE-330)
reNgine through 0.5 relies on a predictable directory name.
CVE-2021-38607 (severity: MEDIUM, weakness: CWE-79)
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
CVE-2021-38608 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges via WAPT Agent.
CVE-2021-3861 (severity: MEDIUM, weakness: CWE-122)
The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hvfp-w4h8-gxvj
CVE-2021-38611 (severity: CRITICAL, weakness: CWE-77)
A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php.
CVE-2021-38612 (severity: HIGH, weakness: CWE-22)
In NASCENT RemKon Device Manager 4.0.0.0, a Directory Traversal vulnerability in a log-reading function in maintenance/readLog.php allows an attacker to read any file via a specialized URL.
CVE-2021-38613 (severity: CRITICAL, weakness: CWE-434)
The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution.
CVE-2021-38614 (severity: HIGH, weakness: CWE-787)
Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-38615 (severity: HIGH, weakness: NVD-CWE-Other)
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, standard, or admin) to view and modify information.
CVE-2021-38616 (severity: HIGH, weakness: NVD-CWE-Other)
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.
CVE-2021-38617 (severity: HIGH, weakness: NVD-CWE-Other)
In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.
CVE-2021-38618 (severity: HIGH, weakness: NVD-CWE-Other)
In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's credentials except the password) to get access to an account. This occurs because of JSESSIONID mismanagement.
CVE-2021-38619 (severity: MEDIUM, weakness: CWE-79)
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).
CVE-2021-3862 (severity: MEDIUM, weakness: CWE-79)
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-38621 (severity: CRITICAL, weakness: NVD-CWE-Other)
The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.
CVE-2021-38623 (severity: HIGH, weakness: CWE-404)
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
CVE-2021-38624 (severity: MEDIUM, weakness: CWE-639)
Windows Key Storage Provider Security Feature Bypass Vulnerability
CVE-2021-38625 (severity: HIGH, weakness: CWE-269)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-38626 (severity: HIGH, weakness: CWE-269)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-38628 (severity: HIGH, weakness: CWE-269)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2021-38629 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
CVE-2021-3863 (severity: MEDIUM, weakness: CWE-79)
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-38630 (severity: HIGH, weakness: CWE-269)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-38631 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CVE-2021-38632 (severity: MEDIUM, weakness: NVD-CWE-Other)
BitLocker Security Feature Bypass Vulnerability
CVE-2021-38633 (severity: HIGH, weakness: CWE-269)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2021-38634 (severity: HIGH, weakness: CWE-269)
Microsoft Windows Update Client Elevation of Privilege Vulnerability
CVE-2021-38635 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
CVE-2021-38636 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability
CVE-2021-38637 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Storage Information Disclosure Vulnerability
CVE-2021-38638 (severity: HIGH, weakness: CWE-269)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2021-38639 (severity: HIGH, weakness: CWE-269)
Win32k Elevation of Privilege Vulnerability
CVE-2021-3864 (severity: HIGH, weakness: CWE-284)
A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges.
CVE-2021-38641 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge for Android Spoofing Vulnerability
CVE-2021-38642 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge for iOS Spoofing Vulnerability
CVE-2021-38644 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
CVE-2021-38645 (severity: HIGH, weakness: NVD-CWE-Other)
Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2021-38646 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
CVE-2021-38647 (severity: CRITICAL, weakness: NVD-CWE-Other)
Open Management Infrastructure Remote Code Execution Vulnerability
CVE-2021-38648 (severity: HIGH, weakness: NVD-CWE-Other)
Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2021-38649 (severity: HIGH, weakness: NVD-CWE-Other)
Open Management Infrastructure Elevation of Privilege Vulnerability
CVE-2021-38650 (severity: LOW, weakness: NVD-CWE-Other)
Microsoft Office Spoofing Vulnerability
CVE-2021-38651 (severity: LOW, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-38652 (severity: LOW, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-38653 (severity: HIGH, weakness: CWE-787)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2021-38654 (severity: HIGH, weakness: CWE-129)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2021-38655 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-38656 (severity: HIGH, weakness: CWE-416)
Microsoft Word Remote Code Execution Vulnerability
CVE-2021-38657 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Office Graphics Component Information Disclosure Vulnerability
CVE-2021-38658 (severity: HIGH, weakness: CWE-843)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-38659 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-3866 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
CVE-2021-38660 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2021-38661 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-38662 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Fast FAT File System Driver Information Disclosure Vulnerability
CVE-2021-38663 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows exFAT File System Information Disclosure Vulnerability
CVE-2021-38665 (severity: MEDIUM, weakness: NVD-CWE-Other)
Remote Desktop Protocol Client Information Disclosure Vulnerability
CVE-2021-38666 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2021-38667 (severity: HIGH, weakness: CWE-269)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-38669 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2021-38671 (severity: HIGH, weakness: CWE-269)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-38672 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2021-38674 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
CVE-2021-38675 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later