Vulnerability fixed in QNAP QTS

QNAP has fixed a vulnerability in QTS. A malicious party could potentially exploit the vulnerability to inject arbitrary commands into applications. QNAP has released updates to fix the vulnerability in QTS 4.5.1.1495 build 20201123. For more information, see:...

Panasonic Security System Security Vulnerability

The Panasonic WV-S2231L is a webcam from Panasonic Japan. A security vulnerability exists in the Panasonic Security System WV-S2231L version 4.25, which allows denying service to the administrative control panel via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request with a factory URI set by...

Subrion Cross-Site Scripting Vulnerability (CNVD-2020-75156)

Subrion is a powerful and easy to use PHP content management system with full source editing, per page permissions, user activity monitoring and other powerful features. A cross-site scripting vulnerability exists in Subrion 4.2.1. The vulnerability can be exploited to conduct a cross-site...

CVE-2020-29189

Incorrect Access Control vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS...

Terramaster TOS Permission License and Access Control Issues Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. A security vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which can be exploited by a remote,...

Terramaster TOS Path Traversal Vulnerability

Terramaster TOS is a Linux-based operating system dedicated to the erraMaster Cloud Storage NAS server from Shenzhen Tumi Electronic Technology Terramaster in China. A path traversal vulnerability exists in TerraMaster TOS version 4.2.06 and earlier versions, which allows a remote authenticated...

PT-2020-17380 · Terramaster · Terramaster Tos

Name of the Vulnerable Software and Affected Versions: TerraMaster TOS versions 4.2.06 and earlier Description: An unauthenticated command-execution issue exists via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. Recommendations: For TerraMaster TOS versio...

BigProf Online Invoicing System 跨站脚本漏洞

BigProf Online Invoicing System OIS is an easy invoicing tool for small businesses, consultants and freelancers created using AppGini. A stored cross-site scripting vulnerability exists in BigProf Online Invoicing System versions prior to 4.0. The vulnerability stems from the product failing to...

Malwarebytes Endpoint Protection Backlink Vulnerability

Malwarebytes Endpoint Protection is an endpoint protection software from the US-based Malwarebytes Inc. The software provides complete malware protection and remediation with accurate threat detection, proactive threat blocking, and thorough remediation. A security vulnerability exists in...

S-cart Cross-Site Scripting Vulnerability

S-cart is a Php-based e-commerce management platform for the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from vulnerability to administration panel cross-site scripting XSS attacks. An attacker can exploit the vulnerability to execu...

Dell BSAFE Micro Edition Suite 缓冲区错误漏洞

The Dell BSAFE Micro Edition Suite is a Dell development toolkit that provides encryption, certificate and transport layer security for c/c++ applications, devices and systems. A buffer overflow vulnerability exists in Dell BSAFE Micro Edition Suite version 4.5, which stems from vulnerability to...

kernel: TOCTOU mismatch in the NFS client code

A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation...

kernel: umask not applied on filesystem without ACL support

A vulnerability was found in NFSv4.2 in the Linux kernel, where a server fails to correctly apply umask when creating a new object on filesystem without ACL support for example, ext4 with the "noacl" mount option. This flaw allows a local attacker with a user privilege to cause a kernel informati...

Xen License Issues Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen throu...

Xen Handling Logic Error Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. A processing logic error vulnerability...

Xen Buffer Error Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen versi...

Xen Resource Management Error Vulnerability

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen versi...

Xen Code Issues Vulnerabilities

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen versi...

DEBIAN-CVE-2020-13988

An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uipprocess in net/ipv4/uip.c...

Apache Tapestry 代码问题漏洞

Apache Tapestry is the United States Apache Apache Foundation of a Web application framework written in the Java language . A deserialization vulnerability exists in Apache Tapestry version 4, which originates from an attempt to deserialize the "sp" parameter before calling the page's...