QNAP QuTS hero Multiple Vulnerabilities (QSA-23-33)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

QNAP QuTS hero Multiple Vulnerabilities (QSA-23-30, QSA-23-47)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

QNAP QuTScloud c5.x < c5.1.5.2651 Multiple Vulnerabilities

QNAP QuTScloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutscloud"; ifdescripti...

PT-2024-18197 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: A critical issue in the calendar feature of Microsoft Outlook exposes Windows login credentials to remote theft. To protect against this, enabling multi-factor authentication is...

Use after free in libpulse-binding

Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...

PT-2024-12252 · Ibm · Ibm Security Verify Access Appliance +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Appliance versions 10.0.0.0 through 10.0.6.1 IBM Security Verify Access Docker versions 10.0.0.0 through 10.0.6.1 Description: The issue could allow an attacker to cause a denial of service due to uncontrolled...

PT-2024-19038 · Unknown · Scribit Shortcodes Finder

Name of the Vulnerable Software and Affected Versions: Scribit Shortcodes Finder versions 1.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versio...

PT-2024-14460 · Unknown · Live Composer Team Page Builder

Name of the Vulnerable Software and Affected Versions: Live Composer Team Page Builder versions 1.5.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-14250 · Unknown · Everest Forms

Name of the Vulnerable Software and Affected Versions: Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! versions n/a through 2.0.4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-sit...

PT-2024-13433 · Connectwise · Connectwise Screenconnect

Name of the Vulnerable Software and Affected Versions: ConnectWise ScreenConnect versions through 23.8.4 Description: The issue allows man-in-the-middle attackers to achieve remote code execution via crafted messages. Recommendations: For ConnectWise ScreenConnect versions through 23.8.4, update ...

PT-2024-13653 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions through 7250 Description: The issue allows SQL Injection in the aggregate report feature. There is no information provided about the estimated number of potentially affected devices worldwide or details...

PT-2024-19316 · Unknown · Robosoft Photo Gallery

Name of the Vulnerable Software and Affected Versions: RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery versions 3.2.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stor...

PT-2024-19910 · WordPress · Bplugins Pdf Poster

Name of the Vulnerable Software and Affected Versions: bPlugins PDF Poster – PDF Embedder Plugin for WordPress versions 2.1.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Reflected XS...

PT-2024-20084 · Unknown · Energy Management Controller With Cloud Services

Name of the Vulnerable Software and Affected Versions: Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description: A cross-site request forgery issue allows a remote unauthenticated attacker to change the product settings. Recommendations: For...

CVE-2024-24558 react-query-streamed-hydration xss

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input e.g. by redirecting...

PT-2024-1491 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions prior to 121.0.2277.83 Description: The issue is related to the exploitation of Microsoft Edge's Marketing API, allowing attackers to covertly install browser extensions without user consent. This could...

PT-2025-1930 · Isc +11 · Bind 9 +11

Name of the Vulnerable Software and Affected Versions: BIND 9 versions 9.18.0 through 9.18.32 BIND 9 versions 9.20.0 through 9.20.4 BIND 9 versions 9.21.0 through 9.21.3 BIND 9 versions 9.18.11-S1 through 9.18.32-S1 Description: Clients using DNS-over-HTTPS DoH can exhaust a DNS resolver's CPU...

PT-2024-19233 · WordPress · Wp Overnight Pdf Invoices & Packing Slips

Name of the Vulnerable Software and Affected Versions: WP Overnight PDF Invoices & Packing Slips for WooCommerce versions 3.7.5 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows fo...

PT-2024-13161 · Line · Line

Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 Description: An issue in the Yoruichi hobby base mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. Recommendations: For Line version 13.6.1, update to a...