CVE-2024-53694 QVPN Device Client, Qsync, Qfinder Pro

A time-of-check time-of-use TOCTOU race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability...

CVE-2024-53694 QVPN Device Client, Qsync, Qfinder Pro

A time-of-check time-of-use TOCTOU race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability...

CVE-2024-53694

The CVE-2024-53694 issue is a TOCTOU race condition affecting QNAP products: QVPN Device Client for Mac, Qsync for Mac, and Qfinder Pro Mac. The vulnerability could allow local attackers with user access to access otherwise unauthorized resources. Mitigation/fix: patches are available in QVPN Dev...

CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

CVE-2025-27604

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

GHSA-6QVP-39MM-95V8 com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

Impact A user that doesn't have programming rights can execute arbitrary code when creating a page using the Migration Page template. A possible attack vector is the following: Create a page and add the following content: confluencepro.job.question.advanced.input=/html async async="true"...

CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

CVE-2025-27603

CVE-2025-27603 affects the XWiki Confluence Migrator Pro — a tool used to import Confluence packages into XWiki. The issue arises from an unescaped translation when creating a page with the Migration Page template, allowing a user lacking programming rights to execute arbitrary code. The vulnerab...

CVE-2025-27604: Exposure of Sensitive Information to an Unauthorized Actor

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

CVE-2024-53694: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check time-of-use TOCTOU race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources. We have already fixed the vulnerability...

CVE-2025-27603: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0...

PT-2025-10115

Name of the Vulnerable Software and Affected Versions XWiki Confluence Migrator Pro versions prior to 1.11.7 Description The application's homepage is publicly accessible, allowing guests to download packages that may contain sensitive information. Recommendations For versions prior to 1.11.7,...

PT-2025-10097

Name of the Vulnerable Software and Affected Versions XWiki Confluence Migrator Pro versions prior to 1.2.0 Description A user without programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This issue allows for the...

QVPN Device Client, QNAP Systems Qsync, and QNAP Systems Qfinder Pro have security vulnerabilities

QNAP Systems QVPN Device Client and others are products of China-based Weilian Technology QNAP Systems.QVPN Device Client is a client software program used to manage connections to VPN servers running on QNAP devices.QNAP Systems Qfinder Pro is a utility for quickly searching and managing a NAS...

PT-2025-10107

Name of the Vulnerable Software and Affected Versions QVPN Device Client for Mac versions prior to 2.2.5 Qsync for Mac versions prior to 5.1.3 Qfinder Pro Mac versions prior to 7.11.1 Description A time-of-check time-of-use TOCTOU race condition issue has been reported, which could allow local...

CVE-2025-2040

A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack ca...