CVE-2021-28805

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read application data. This issue affects: QNAP Systems Inc. QSS versions prior to 1.0.3 build 20210505 on QSW-M2108-2C; versions prior to 1.0.3 build 20210505 on QSW-M2108-2S; versions prior to 1.0.3 build 20210505 on QSW-M2108R-2C; versions prior to 1.0.12 build 20210506 on QSW-M408.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-540CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-288065.4A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackCVE-2021-288075.4A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability alCVE-2021-288099.8An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability alloCVE-2021-288107.5If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. RoCVE-2021-288117.2If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this CVE-2021-288128.8A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remCVE-2021-288137.5A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuCVE-2021-288148.8An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to cCVE-2021-288154.9Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability alCVE-2021-288168.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerabCVE-2021-288177.8The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerabilityCVE-2021-288187.8The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache),
CVE-2021-28805: Medium severity, CVSS 5.5 | Vulnix