CVE-2025-22490

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29872

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2024-13088

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later...

CVE-2024-13087

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2025-29885 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...

CVE-2025-29884

The CVE-2025-29884 issue affects QNAP File Station 5. The root cause is improper certificate validation in File Station 5, which could allow remote attackers who have user access to compromise system security. Affected versions are File Station 5 prior to 5.5.6.4791; remediation is to update to 5...

CVE-2025-29883 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...

CVE-2025-22484

CVE-2025-22484 affects QNAP File Station 5. It is a resource management error caused by unrestricted allocation, which can allow a user with an account to exhaust resources and prevent other systems, applications, or processes from accessing the same resource. Affected versions are prior to 5.5.6...

CVE-2025-29872 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2025-29876

File Station 5 is affected by a NULL pointer dereference (remote DoS) in versions prior to 5.5.6.4847. The issue can be triggered by a user account; upgrading to File Station 5 5.5.6.4847 and later resolves the vulnerability. The connected PT-2025-24300 entry confirms affected versions and the re...

CVE-2025-29877 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-30279 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station ...

CVE-2025-30279

CVE-2025-30279 affects QNAP/File Station 5. An improper certificate validation vulnerability can allow a remote attacker who has a user account to compromise the system. The issue is fixed in File Station 5, version 5.5.6.4847 and later. Public risk details (exploit status, scope, or vectors) not...

CVE-2025-33031

CVE-2025-33031 : Affected product is QNAP File Station 5. Versions prior to 5.5.6.4847 are vulnerable to an improper certificate validation issue. Exploitation requires the attacker to have a valid user account and remote access, potentially compromising system security. The issue is fixed in Fil...

CVE-2025-49009 Para Inserts Sensitive Information into Log File for Facebook authentication

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in FacebookAuthFilter.java results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access...

CVE-2025-48493 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if...

PT-2025-23987

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue concerns the behavior of os.OpenFile when the target path is a dangling symlink. On Unix systems, os.OpenFile with O CREATE and O EXCL flags never follows symlinks. However, on...

CVE-2025-46339

FreshRSS prior to version 1.26.2 is vulnerable to favicon cache poisoning via a manipulated feed URL and an attacker-controlled proxy with SSL verification disabled. The underlying issue is the favicon hash computation, which hashes the feed URL and a salt but omits proxy address, proxy protocol,...

CVE-2025-49002

DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in...

CVE-2025-49000

InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in label-sheet plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a...