PT-2023-8838 · Qnap · Qnap Qts +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.0.1.2376 build 20230421 QNAP QuTS hero versions prior to h5.0.1.2376 build 20230421 QNAP QuTScloud versions prior to c5.1.0.2498 Description: An OS command injection vulnerability has been reported to affect sever...

Fedora 38 : matrix-synapse (2023-f8d216faed)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-f8d216faed advisory. Update to 1.95.1 CVE-2023-43796 ---- Update to v1.95.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

PT-2023-8780 · Qnap · Qts +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.5.2645 build 20240116 QTS versions prior to 4.5.4.2627 build 20231225 QuTS hero versions prior to h5.1.5.2647 build 20240118 QuTS hero versions prior to h4.5.4.2626 build 20231225 QuTScloud versions prior to...

SolarWinds Network Configuration Manager Security Vulnerability

SolarWinds Network Configuration Manager is an easy-to-use solution from SolarWinds USA. A security vulnerability exists in SolarWinds Network Configuration Manager that stems from susceptibility to a sensitive information disclosure vulnerability that allows users with administrative access to...

CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

Design/Logic Flaw

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

CVE-2023-43796 Synapse vulnerable to leak of remote user device information

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

CVE-2023-43796 Synapse vulnerable to leak of remote user device information

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or...

UCS@school Security Breach

UCS@school is a comprehensive solution that provides access to school infrastructure and applications as well as a complete toolset for operating them. A security vulnerability exists in versions prior to UCS@school 4.4v5-errata, which stems from an incorrect LDAP ACL in ucs-school-ldap-acls-mast...

Application Layer Gateway (ALG) Explained: What it is & Why You Need it ?

Snippet When you hear "Application Layer Gateway," or ALG for short, think of it as a network traffic conductor. It's the unsung hero that examines data packets, making sure they follow specific rules and get to where they're supposed to go—securely and efficiently. Quick Facts Definition In the...

PT-2023-29720 · Unknown · Leadsquared Suite

Name of the Vulnerable Software and Affected Versions: LeadSquared Suite plugin versions 0.7.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts to be stored o...

CVE-2023-4274

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89. This allows authenticated attackers with administrative privileges to delete the contents of arbitrary directories on the server, which can be a critical...

PT-2023-30043 · WordPress · Wp Customer Reviews

Name of the Vulnerable Software and Affected Versions: WP Customer Reviews plugin for WordPress versions up to, and including, 3.6.6 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

IT administrators’ passwords are awful too

The key is under the doormat by the front door. The administrator password is "admin". These are easy to remember clues when you are providing entrance to someone you trust. The problem is that they are also enormously easy to guess. It’s where we would expect an unwanted visitor to check first,...

QNAP QTS / QuTS hero Multiple Vulnerabilities (QSA-23-41)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-41 advisory. - A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could...

CVE-2023-4620 Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators...

QNAP QTS Multiple Vulnerabilities (QSA-23-41)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...