CVE-2021-38678

CVE-2021-38678 describes an open redirect vulnerability in QNAP QcalAgent. The issue allows an attacker to redirect users to an untrusted page that could host malware. Affected product is QNAP QcalAgent (version affected: prior to 1.1.7; fixed in 1.1.7 and later). Impact aligns with the CVSS: net...

CVE-2021-38677

CVE-2021-38677 affects QNAP QcalAgent and is a cross-site scripting (XSS) vulnerability. The issue arises from insufficient input sanitization in user-supplied data, enabling an attacker to inject malicious code via crafted input. Exploitation details are not provided in the accessible documents,...

CVE-2023-41289

CVE-2023-41289 affects QcalAgent and is an OS command injection vulnerability that could allow authenticated users to execute commands over the network. The issue is fixed in QcalAgent version 1.1.8 and later; upgrade to 1.1.8+ to resolve. The available sources consistently describe the vulnerabi...