CVE-2023-23354

CVE-2023-23354 affects QNAP QuLog Center. The vulnerability is an XSS flaw in QuLog Center before specific fixed versions, allowing remote attackers with user access to bypass security or read data. Affected versions include prior to 1.3.1.645, prior to 1.4.1.691, and prior to 1.5.0.738. The fixe...

CVE-2023-23356

CVE-2023-23356 is a command-injection vulnerability in QNAP QuFirewall. The issue allows remote attackers who have gained administrator access to execute arbitrary commands via the QuFirewall module on affected QNAP OS versions. Affected/impacted component: QuFirewall (QNAP devices). Root cause d...

CVE-2023-23357 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the...

CVE-2023-23357 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the...

RHEL 9 : kernel (RHSA-2024:11482)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11482 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: arm64: Disassociate vcpus from...

CVE-2024-43106

A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of...

CVE-2024-41145

A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams work or school 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the...

Fortinet FortiManager 操作系统命令注入漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

The vulnerability of the Ruijie Reyee OS operating system lies in the premature release of resources during its operation period. This allows attackers to interrupt legitimate user sessions and cause service failures.

The vulnerability of the Ruijie Reyee OS is related to the premature release of resources during its operation. Exploiting this vulnerability allows a remote attacker to interrupt a legitimate user’s session and cause service failures...

VulnCheck KEV: CVE-2019-11001

Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root...

The vulnerability of the invscout component in AIX and VIOS operating systems allows a perpetrator to execute arbitrary commands.

The vulnerability of the invscout component in AIX and VIOS operating systems is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2024-55919

Improper input validation on generic SSO login...

Multiple vulnerabilities in SHARP routers

Overview SHARP routers contain multiple vulnerabilities listed below. OS command injection vulnerability in the HOST name configuration screen CWE-78 - CVE-2024-45721 The hidden debug function is enabled CWE-489 - CVE-2024-46873 Buffer overflow vulnerability in the hidden debug function CWE-120 -...

virtualenv: potential command injection via virtual environment activation scripts

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system...

virtualenv: potential command injection via virtual environment activation scripts

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system...

virtualenv: potential command injection via virtual environment activation scripts

A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,integrity and availability of the system...

The vulnerability of the UPDATES_ExtractFile function in the Visteon Infotainment automotive application platform allows a hacker to execute arbitrary code.

The vulnerability of the UPDATESExtractFile function in Visteon Infotainment’s automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows an attacker to execute arbitrary code in the basic operating system...

The vulnerability in the implementation of the LDAP service protocol for Windows operating systems allows a perpetrator to cause a service failure.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in Windows operating systems is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Windows Mobile Broadband Driver for Microsoft Windows operating systems allows attackers to gain increased privileges.

The vulnerability of the Windows Mobile Broadband Driver for Microsoft Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of the “sta_log_htm” application programming interface in the microprogramming-based wireless access points of Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the “staloghtm” application programming interface in the microprogramming-based wireless access points of Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO models exists due to the lack of measures taken to neutralize the special elements used in the operating syst...