QNAP Releases Security Updates for QNAP Helpdesk

QNAP Systems has released security updates to address vulnerabilities in QNAP Helpdesk. An attacker could exploit these vulnerabilities to take control of an affected QNAP network-attached storage NAS device. The Cybersecurity and Infrastructure Security Agency CISA encourages users and...

CVE-2018-19948

The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery CSRF vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and...

PT-2020-3794 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions prior to the fixed version Description: An information disclosure issue exists when attaching files to Outlook messages, potentially allowing users to share attached files with anonymous users, even when they should...

Command injection

Multiple ZyXEL network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using th...

ZyXEL NAS Command Injection (CVE-2020-9054)

A command injection vulnerability exists in Multiple ZyXEL network-attached storage NAS devices. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

QNAP Systems QNAP QTS Command Injection Vulnerability

QNAP Systems QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A command injection vulnerability exists in File Station in QNAP Systems QNAP QTS. The vulnerability exists due to a...

Buffer Overflow Vulnerability in Multiple Qualcomm Products (CNVD-2020-16071)

Qualcomm MDM9206 and others are products of Qualcomm Incorporated.The MDM9206 is a central processing unit CPU product.The MDM9640 is a central processing unit CPU product.The SDX24 is a modem.The MDM9640 is a central processing unit CPU product.The MDM9640 is a central processing unit CPU...

TerraMaster F2-210 Information Disclosure Vulnerability

The Terramaster F2-210 is an entry-level two-drive NAS. An information disclosure vulnerability exists in the TerraMaster F2-210. An attacker could exploit the vulnerability to download log files...

USN-4163-2: Linux kernel (Xenial HWE) vulnerabilities

USN-4163-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. It was discovered that a race condition existed in the ARC EMAC ethernet driver for th...

Debian DLA-1885-1 : linux-4.9 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-18509 Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAPNETADMIN capability in a...

Debian DSA-4497-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2015-8553 Jan Beulich discovered that CVE-2015-2150 was not completely addressed. If a PCI physical function is passed through to a Xen guest, th...

Debian DLA-1884-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-18509 Denis Andzakovic reported a missing type check in the IPv4 multicast routing implementation. A user with the CAPNETADMIN capability in a...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4076-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4076-1 advisory. It was discovered that a race condition existed in the Serial Attached SCSI SAS implementation in the Linux kernel. A local attacker could possibly use...

CVE-2019-3734

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users...

Network Data Management Protocol (NDMP) Detection

A NDMP Service is running at this host. NDMP is used primarily for backup of network-attached storage NAS devices, such as storage systems. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Seagate NAS OS Access Control Error Vulnerability

Seagate NAS OS is a NAS Network Attached Storage operating system from Seagate USA. An access control error vulnerability exists in /api/external/7.0/system.System.getinfos in the Seagate NAS OS 4.3.15.1 file. The vulnerability arises from the network system or product not properly restricting...

PT-2019-9473

Name of the Vulnerable Software and Affected Versions ZrLog version 2.0.3 Description An issue was discovered in the file upload area, where a stored XSS attack can be performed via a crafted attached/file/ pathname. Recommendations For ZrLog version 2.0.3, consider restricting access to the file...

CVE-2018-17421: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname...

UBUNTU-CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

The vulnerability of the Microsoft Outlook email client, related to an error in processing the “Default Link Type” setting, allows a hacker to gain access to protected information.

The vulnerability of the Microsoft Outlook email client is related to a processing error in the “Default Link Type” setting. Exploiting this vulnerability can allow an attacker to gain access to protected information through a file attached to messages...