QNAP Qsync Central: Path traversal vulnerability

QNAP Qsync Central is a cloud-based file synchronization service on NAS from Taiwan, China-based QNAP Technology QNAP. A path traversal vulnerability exists in QNAP Qsync Central versions prior to version 4.5.0.7, which stems from susceptibility to a path traversal attack that could result in...

PT-2025-35279

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.5.3145 build 20250526 QNAP versions prior to QuTS hero h5.2.5.3138 build 20250519 Description A path traversal vulnerability exists in QNAP operating systems. A remote attacker who has obtained a user account can...

QNAP Qsync Central: Path traversal vulnerability

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. A path traversal vulnerability exists in QNAP Qsync Central, which can be exploited by an attacker to read unexpected file...

CVE-2025-33036: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2025-30271: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following...

CVE-2025-33037: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

QNAP Qsync Central: Path traversal vulnerability

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. A path traversal vulnerability exists in QNAP Qsync Central, which can be exploited by an attacker to read unexpected file...

QNAP VioStor path traversal vulnerability

QNAP VioStor is a software for storing and managing video surveillance systems from Taiwan, China-based QNAP Technology QNAP. A path traversal vulnerability exists in QNAP VioStor, which stems from susceptibility to a path traversal attack that could result in reading unexpected files or system...

Malicious code in import-license-checker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c41ca4c8119fa20f7f5915b34de59f879b77fedf237cbbf5a69e46ddbeded428 Package exfiltrates content of .env files to a remote target --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Brocade SANnav Information Disclosure

The vulnerability of the Brocade SANnav network management software lies in the ability to expose system data to unauthorized individuals. Exploiting this vulnerability could allow a intruder to gain unauthorized access to protected information...

Fortinet FortiClientWindows Info Disclosure

The vulnerability of Fortinet FortiClientWindows protection mechanisms involves the disclosure of system data by unauthorized parties within the controlled area. Exploiting this vulnerability can allow attackers to disclose the protected information...

Brocade SANnav Information Disclosure

The vulnerability of the Brocade SANnav network management software lies in the ability to expose system data to unauthorized individuals. Exploiting this vulnerability could allow a intruder to gain unauthorized access to protected information...

Malicious code in flask-tdg-cyberx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5dae82b81352867ea79466352b02c279be8b7ca2f0415f0534058e20b943436 Package is prepared for exfiltration of detailed data about the running system. The exact behaviour depends on the version: some does nothing, some exfiltrate...

CVE-2025-55280 Information Disclosure Vulnerability in ZKTeco WL20

This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the...

NVIDIA Graphics Processor Information Disclosure

The vulnerability of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors’ microprogramming software relates to the disclosure of system data by unauthorized individuals. Exploiting this vulnerability can allow a hacker to gain unauthorized access to protected information...

NVIDIA Graphics Processor Information Disclosure

The vulnerability of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors’ microprogramming software relates to the disclosure of system data by unauthorized individuals. Exploiting this vulnerability can allow a hacker to gain unauthorized access to protected information...

SD-WAN Function Unauthorized Access

The vulnerability of the SD-WAN function in the PAN-OS operating system relates to the exposure of system data to unauthorized individuals. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Digiwin EAI security vulnerabilities

Digiwin EAI is a cross-system data exchange and automation platform from China-based Digiwin. A security vulnerability exists in Digiwin EAI that stems from an elevation of privilege issue in a specific API that could allow a remote attacker to elevate privileges to the administrator level...

PT-2025-35974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw where a maliciously fuzzed file system can trigger a BUG ON in the ext4 update inline data function when an inode has the INLINE DATA FL flag set but is...

Marvell QConvergeConsole path traversal vulnerability (CNVD-2025-20446)

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. Marvell QConvergeConsole has a path traversal vulnerability that is caused by an error in the getDriverTmpPath method. An attacker could exploit the vulnerability to disclose information in the...