Starwindsoftware

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Starwindsoftware product.

RSS Feeds for Starwindsoftware security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Starwindsoftware products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Starwindsoftware Sorted by Most Security Vulnerabilities since 2018

Starwindsoftware Starwind Virtual San23 vulnerabilities

Starwindsoftware Starwind San Nas5 vulnerabilities

Starwindsoftware Command Center4 vulnerabilities

Starwindsoftware Iscsi San2 vulnerabilities

Starwindsoftware Nas2 vulnerabilities

Starwindsoftware San2 vulnerabilities

Starwindsoftware Starwind Hyperconverged Appliance2 vulnerabilities

Starwindsoftware San Nas1 vulnerability

By the Year

In 2025 there have been 0 vulnerabilities in Starwindsoftware. Starwindsoftware did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2025	0	0.00
2024	0	0.00
2023	0	0.00
2022	7	8.76
2021	9	7.38
2020	7	5.74
2019	0	0.00
2018	7	5.71

It may take a day or so for new Starwindsoftware vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Starwindsoftware Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2022-32268	Jun 03, 2022	StarWind SAN and NAS v0.2 build 1914 allow remote code execution StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows changing the hostname, doesnt check a new hostname parameter. It goes directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges.	Starwind San Nas
CVE-2022-24552	Feb 06, 2022	A flaw was found in the REST API in StarWind Stack A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesnt check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.	Nas San
CVE-2022-24551	Feb 06, 2022	A flaw was found in StarWind Stack A flaw was found in StarWind Stack. The endpoint for setting a new password doesnt check the current username and old password. An attacker could reset any local user password (including system/administrator user) using any available user This affects StarWind SAN and NAS v0.2 build 1633.	Nas San
CVE-2013-20004	Feb 06, 2022	A flaw was found in StarWind iSCSI target A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on each connection attempt. An attacker could create a denial of service state by trying to connect a non-existent target multiple times. This affects iSCSI SAN (Windows Native) Version 6.0, build 2013-01-16.	Iscsi San
CVE-2007-20001	Feb 06, 2022	A flaw was found in StarWind iSCSI target A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the StarWind service socket, which could lead to denial of service. This affects iSCSI SAN (Windows Native) Version 3.2.2 build 2007-02-20.	Iscsi San
CVE-2021-4034	Jan 28, 2022	A local privilege escalation vulnerability was found on polkit's pkexec utility A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.	Starwind Virtual San Starwind Hyperconverged Appliance Command Center And others...
CVE-2022-23858	Jan 24, 2022	A flaw was found in the REST API A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.	Command Center
CVE-2021-43527	Dec 08, 2021	NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.	Starwind Virtual San Starwind San Nas
CVE-2021-42574	Nov 01, 2021	An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0 An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.	Starwind Virtual San
CVE-2021-42739	Oct 20, 2021	The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking.	Starwind San Nas Starwind Virtual San
CVE-2021-41617	Sep 26, 2021	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.	Starwind Virtual San
CVE-2021-37750	Aug 23, 2021	The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.	Starwind Virtual San
CVE-2020-36385	Jun 07, 2021	An issue was discovered in the Linux kernel before 5.10 An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.	Starwind San Nas Starwind Virtual San
CVE-2020-36322	Apr 14, 2021	An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.	Starwind Virtual San
CVE-2021-20271	Mar 26, 2021	A flaw was found in RPM's signature check functionality when reading a package file A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.	Starwind Virtual San
CVE-2020-14409	Jan 19, 2021	SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.	Starwind Virtual San
CVE-2020-25656	Dec 02, 2020	A flaw was found in the Linux kernel A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.	Starwind Virtual San
CVE-2020-25704	Dec 02, 2020	A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.	Starwind San Nas Command Center Starwind Virtual San And others...
CVE-2020-25643	Oct 06, 2020	A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7 A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Starwind Virtual San
CVE-2020-0427	Sep 17, 2020	In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171	Starwind Virtual San
CVE-2020-14314	Sep 15, 2020	A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.	Starwind Virtual San
CVE-2020-24394	Aug 19, 2020	In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.	Starwind Virtual San
CVE-2019-20807	May 28, 2020	In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).	Command Center San Nas
CVE-2018-18585	Oct 23, 2018	chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).	Starwind Virtual San
CVE-2018-18584	Oct 23, 2018	In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8 In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.	Starwind Virtual San
CVE-2018-16758	Oct 10, 2018	Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.	Starwind Virtual San
CVE-2018-16738	Oct 10, 2018	tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1.	Starwind Virtual San
CVE-2018-16737	Oct 10, 2018	tinc before 1.0.30 has a broken authentication protocol tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation.	Starwind Virtual San
CVE-2018-3839	Apr 10, 2018	An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2 An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can display a specially crafted image to trigger this vulnerability.	Starwind Virtual San
CVE-2018-3837	Apr 10, 2018	An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2 An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted PCX image can cause an out-of-bounds read on the heap, resulting in information disclosure . An attacker can display a specially crafted image to trigger this vulnerability.	Starwind Virtual San