CVE-2023-45039

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-45044 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-45041 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-45041 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-32975 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-40462 Improper input leads to DoS

The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially result in a Denial of Service DoS condition for ACEManager without impairing other router functions. ACEManager recovers from the DoS condition by restarting withi...

Design/Logic Flaw

TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap options are accepted. In this particular case, the option to create log files is accepted in addition to a host name and even without. A log file is created at...

WordPress Plugin Interact: Embed A Quiz On Your Site Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-5920 Lack Of Secure Keyboard Entry Protection in MacOS Desktop

Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input...

PT-2023-32419 · Mattermost · Mattermost Desktop App

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop for MacOS affected versions not specified Description: The issue is related to Mattermost Desktop for MacOS failing to utilize the secure keyboard input functionality provided by macOS. This failure allows other processes t...

Enhancesoft osTicket Cross-Site Scripting Vulnerability

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in Enhancesoft osTicket v1.17.2. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected into the Label input paramete...

CVE-2023-4999 Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's horizontal-scrolling shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2023-44204

CVE-2023-44204 affects Juniper Networks Junos OS and Junos OS Evolved, via an Improper Validation of Syntactic Correctness of Input in the Routing Protocol Daemon (rpd). A malformed BGP UPDATE packet received on an established BGP session can crash rpd, causing a DoS on both eBGP and iBGP session...

CVE-2023-32972

CVE-2023-32972 affects QNAP QTS/QTS hero/QTScloud line: a buffer copy without input size checking can allow an authenticated administrator to execute code over the network. Root cause is improper input size handling in the affected component; no exploit details are provided in the documents. Affe...

CVE-2023-32971 QTS, QuTS hero, QuTScloud

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-32971 QTS, QuTS hero, QuTScloud

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

PT-2023-29320 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server versions 3.1 and earlier Description: The issue arises from insufficient encryption of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is stored via the "POST" method at the...

CVE-2023-23363

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 bui...

QNAP Systems Multimedia Console Security Vulnerability

QNAP Systems Multimedia Console is a multimedia controller for centralized management of QTS devices from QNAP Systems. A security vulnerability exists in QNAP Systems Multimedia Console that stems from not checking a copy of the buffer for the size of the input vulnerability...

Cross Site Scripting (XSS)

Decidim is vulnerable to Cross Site Scripting XSS vulnerability. The vulnerability is due to not sanitising user input correctly while processing proposals leading to attacker make other users endorse or support proposals they have no intention of supporting or endorsing...