CVE-2021-38678

An open redirect vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later

• CWE-601
• CWE-601

• https://www.qnap.com/en/security-advisory/qsa-21-60Vendor Advisory
• https://www.qnap.com/en/security-advisory/qsa-21-60Vendor Advisory

Published

Jan 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3867Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-38671Windows Print Spooler Elevation of Privilege Vulnerability7.8
• CVE-2021-38672Windows Hyper-V Remote Code Execution Vulnerability8
• CVE-2021-38674A cross-site scripting (XSS) vulnerability has been reported…6.1
• CVE-2021-38675A cross-site scripting (XSS) vulnerability has been reported…5.4
• CVE-2021-38677A cross-site scripting (XSS) vulnerability has been reported…6.1
• CVE-2021-38679An improper authentication vulnerability has been reported t…9.8
• CVE-2021-3868Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-38680A cross-site scripting (XSS) vulnerability has been reported…6.1
• CVE-2021-38681A reflected cross-site scripting (XSS) vulnerability has bee…5.4
• CVE-2021-38682A stack buffer overflow vulnerability has been reported to a…9.8
• CVE-2021-38684A stack buffer overflow vulnerability has been reported to a…9.8