CVE-2021-34362: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Med...

PT-2021-20474

Name of the Vulnerable Software and Affected Versions: Media Streaming add-on versions prior to 500.0.0.3 Media Streaming add-on versions prior to 430.1.8.12 Description: A command injection issue has been reported, allowing remote attackers to run arbitrary commands on QNAP devices running the...

Media Streaming add-on 命令注入漏洞

Media Streaming add-on is a media streaming add-on. A command injection vulnerability exists in Media Streaming add-on that can be exploited to run arbitrary commands...

WP-Recall < 16.24.48 - Reflected Cross-Site Scripting

The plugin does not escape some filters parameters before outputting them back in attributes when the Commerce add-on is active, leading to Reflected Cross-Site Scripting issues PoC Activate the Commerce Add-On of the plugin and open the below URL...

WP-Recall < 16.24.48 - Reflected Cross-Site Scripting

The plugin does not escape some filters parameters before outputting them back in attributes when the Commerce add-on is active, leading to Reflected Cross-Site Scripting issues Activate the Commerce Add-On of the plugin and open the below URL...

CVE-2021-39857

Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 and earlier, 2020.004.30006 and earlier and 2017.011.30199 and earlier are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to check for existence of loca...

CVE-2021-39857: Exposure of Sensitive Information to an Unauthorized Actor

Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 and earlier, 2020.004.30006 and earlier and 2017.011.30199 and earlier are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to check for existence of loca...

PT-2021-6908

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC add-on for Internet Explorer versions 2021.005.20060 and earlier Adobe Acrobat Reader DC add-on for Internet Explorer versions 2020.004.30006 and earlier Adobe Acrobat Reader DC add-on for Internet Explorer versions...

CVE-2021-32811

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional...

VulnCheck KEV: CVE-2020-36195

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedi...

CVE-2020-36195

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedi...

Sql injection

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedi...

PT-2021-4453

Name of the Vulnerable Software and Affected Versions QNAP NAS versions prior to QTS 4.3.3.1624 Build 20210416 QNAP NAS versions prior to QTS 4.3.6.1620 Build 20210322 QNAP NAS Multimedia Console versions prior to 1.3.4 QNAP NAS Media Streaming add-on versions prior to 430.1.8.8 QNAP NAS Media...

CVE-2020-27851

Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...

CVE-2020-27851

Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...

PT-2021-11312

Name of the Vulnerable Software and Affected Versions: TIBCO EBX Add-ons versions 4.4.2 and below Description: The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability...

What’s New in InsightIDR: Q4 2020 in Review

Throughout the year, we’ve provided roundups of what’s new in InsightIDR, our cloud-based SIEM tool see the H1 recap post, and our most recent Q3 2020 recap post. As we near the end of 2020, we wanted to offer a closer look at some of the recent updates and releases in InsightIDR from Q4 2020...

Privilege escalation

Uncontrolled search path in IntelR SCS Add-on for Microsoft SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-12320

Uncontrolled search path in IntelR SCS Add-on for Microsoft SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-12320: Uncontrolled Search Path Element

Uncontrolled search path in IntelR SCS Add-on for Microsoft SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access...