QNAP QuTS hero Multiple Vulnerabilities (QSA-24-32)

QNAP QuTS hero is prone to multiple OS command injection vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

QNAP QuTS hero Multiple Vulnerabilities (QSA-24-33)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

HPESBUX04685 rev.1 - HPE HP-UX 11i v3 ONC and NFS Software, Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS; Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX 11i v3 ONC and NFS Software - Prior to B.11.31.24 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-1999-0195 |...

PT-2024-39079 · WordPress · The Big File Uploads – Increase Maximum File Upload Size

Name of the Vulnerable Software and Affected Versions: The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress versions up to, and including, 2.1.2 Description: The plugin is vulnerable to Full Path Disclosure due to not sanitizing a file path in an error message. This allow...

PT-2024-5949 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.4.2790 build 20240605 QuTS hero versions prior to h4.5.4.2626 build 20231225 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the...

PT-2024-19115 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If...

PT-2024-12487 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 4.5.4.2790 build 20240605 QNAP QuTS hero versions prior to h4.5.4.2790 build 20240606 Description: An OS command injection issue has been reported to affect several QNAP operating system versions. If exploited, the...

PT-2024-31626 · Unknown · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions 6.3.5 and earlier Advanced Custom Fields Pro versions 6.3.5 and earlier Description: A cross-site scripting issue exists, allowing an attacker with the capability setting privilege to store an arbitrary script ...

Google Chrome Security Update (stable-channel-update-for-desktop-2024-09) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:3116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-38988 · Unknown · Focus For Ios

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 130 Description: Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar. Recommendations: For Focus for iOS versions prior to 130, update to version 130 or later to resolve t...

KLA73124 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1...

PT-2024-37957

Name of the Vulnerable Software and Affected Versions NACPremium versions through 01082024 Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows for Blind SQL Injection, which can...

PT-2024-30850 · Woocommerce · Taxi Booking Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Taxi Booking Manager for WooCommerce versions through 1.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacke...

PT-2024-28559 · Cridiostudio · Cridiostudio Listingpro

Name of the Vulnerable Software and Affected Versions: CridioStudio ListingPro versions 2.9.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

PT-2024-30778

Name of the Vulnerable Software and Affected Versions WBW Product Table PRO versions through 1.9.4 Description The software contains an SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially leading to unauthorized...

PT-2024-21587 · WordPress · Betheme

Name of the Vulnerable Software and Affected Versions: Betheme theme for WordPress versions up to, and including, 27.5.6 Description: The issue is related to PHP Object Injection via deserialization of untrusted input of the mfn-page-items post meta value. This allows authenticated attackers with...

PT-2024-6096

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.3 Description The issue is related to a problem in the libexpat library, which is used for parsing XML files. It is caused by the library's failure to properly restrict references to external XML entities. This c...

Medium: docker

Issue Overview: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorizatio...

PT-2024-30783 · Nitropack · Nitropack

Name of the Vulnerable Software and Affected Versions: NitroPack versions 1.16.7 and earlier Description: The issue is related to improper control of code generation, allowing code injection. This is due to a Code Injection vulnerability in NitroPack Inc.'s NitroPack. Recommendations: For version...