PT-2024-18311 · WordPress · Aweber – Free Sign Up Form/Landing Page Builder Plugin For Lead Generation/Email Newsletter Growth

Name of the Vulnerable Software and Affected Versions: AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress versions up to, and including, 7.3.14 Description: The issue allows authenticated attackers with administrator-lev...

QNAP QuTS hero XSS Vulnerability (QSA-24-11)

QNAP QuTS hero is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-21901

A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 2023/11/24 and later QTS...

CVE-2023-47221

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version:...

CVE-2023-32969

A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651...

Command injection

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627...

CVE-2024-21901 myQNAPcloud

A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 2023/11/24 and later QTS...

CVE-2024-21901

CVE-2024-21901 describes a SQL injection in myQNAPcloud that could allow authenticated administrators to inject code via a network. The affected software includes myQNAPcloud and QTS, with fixes in myQNAPcloud 1.0.52+ (2023-11-24) and QTS 4.5.4.2627+ (build 20231225+). The CVSS 3.1 metrics (NVD a...

CVE-2024-21901 myQNAPcloud

A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 2023/11/24 and later QTS...

CVE-2023-34980 QTS, QuTS hero

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627...

CVE-2023-34980 QTS, QuTS hero

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627...

CVE-2023-47221 Photo Station

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version:...

CVE-2023-47221 Photo Station

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version:...

CVE-2023-47221

CVE-2023-47221 is a path traversal vulnerability in QNAP Photo Station. It could allow authenticated administrators to read contents of arbitrary files over the network. Affected software: Photo Station prior to version 6.4.2. Root cause: path traversal vulnerability in the Photo Station componen...

PT-2024-12372 · Qnap · Qutscloud +2

Name of the Vulnerable Software and Affected Versions: QuTScloud versions prior to 5.1.5.2651 QTS versions prior to 5.1.4.2596 build 20231128 QuTS hero versions prior to 5.1.4.2596 build 20231128 Description: A cross-site scripting XSS vulnerability has been reported to affect Network & Virtual...

BIT-ODOO-2021-44476

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read local files on the server, including sensitive configuration files...

BIT-ABANTECART-2022-26521

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the CatalogMedia ManagerImages settings can be changed by an administrator e.g., by configuring .php to be a valid image file type...

QNAP QTS / QuTS hero Multiple Vulnerabilities in QTS, QuTS hero (QSA-23-38)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-38 advisory: - A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could...

QNAP QTS / QuTS hero Multiple Vulnerabilities in QTS, QuTS hero (QSA-23-46)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-46 advisory. - A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the...

CVE-2024-0628

The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...