Description of Update Rollup 2 for System Center 2012 R2 Virtual Machine Manager

Description of Update Rollup 2 for System Center 2012 R2 Virtual Machine Manager Summary This article describes the issues that are fixed in Update Rollup 2 for Microsoft System Center 2012 R2 Virtual Machine Manager VMM. There are two updates available for System Center 2012 R2 VMM. One update...

QNAP NAS Device Buffer Overflow Vulnerability

QNAP NAS is a set of network storage devices for home, SOHO, and SMB users from QNAP Systems, Taiwan. A buffer overflow vulnerability exists in the /home/httpd/cgi-bin/cgi.cgi file of the QNAP NAS device, which can be exploited by an attacker to execute arbitrary code in the context of an...

Atlassian Confluence XSS Vulnerability

Atlassian Confluence is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Atlassian Confluence Jira 5.9.12 - Persistent Cross-Site Scripting Vulnerability

Tempest Security Intelligence Advisory ADV-3/2016 - Atlassian Confluence version 5.9.12 is vulnerable to persistent cross site scripting because it fails to securely validate user controlled data, thus making it possible for an attacker to supply crafted input in order to harm users. The bug occu...

PT-2016-3231 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital MyCloud NAS version 2.11.142 Description: The issue is related to unauthenticated remote command injection as root in the Western Digital MyCloud NAS. This occurs via a modified arg parameter in the POST data to the "/web/goog...

CVE-2016-7879

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution...

Nuuo NVR PHP System Function Unauthenticated Remote Code Execution (CVE-2016-5675)

A remote code execution was discovered in Nuuo Network Video Recording systems with Network Attached Storage. The vulnerability is due to fails in sanitising by the PHP system function. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...

Nuuo NVR Log Parameter Unauthenticated Remote Code Execution (CVE-2016-5674)

A remote code execution was discovered in Nuuo Network Video Recording systems with Network Attached Storage. The vulnerability is due to Improper Input Validation in log parameter. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the Debian GNU/Linux operating system’s package “nas” can lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

QEMU scsi denial of service vulnerability (CNVD-2016-03666)

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A denial of service vulnerability exists in QEMU's scsi. An attacker can exploit this vulnerability to cause a denial of service write across boundaries when the progra...

Uber: reopen #128853 (Information disclosure at lite.uber.com)

Issue in 128853 occurs again. 1. go to https://login.uber.com/oauth/v2/authorize?responsetype=code&redirecturi=https%3A%2F%2Flite.uber.com%2Fauth%2Fcallback&scope=profile%20history%20places%20historylite%20requestreceipt%20request%20paymentbaiduwallet&clientid=y-JJyZRABnEwbJQq4VdQPORo4EKqv0j 2...

Algolia: PHP version disclosed on blog.algolia.com

Hi ON BLOG.ALGOLIA.COM PHP application version is disclosed in response header "X-Powered-By" POC is attached...

[RT-SA-2015-006] Buffalo LinkStation Authentication Bypass

Advisory: Buffalo LinkStation Authentication Bypass An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the...

Buffalo LinkStation 1.34 / 1.69 / 1.70 Authentication Bypass

Advisory: Buffalo LinkStation Authentication Bypass An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the...

Buffalo LinkStation 1.34 / 1.69 / 1.70 Authentication Bypass

An authentication bypass vulnerability in the web interface of a Buffalo LinkStation Duo Network Attached Storage NAS device allows unauthenticated attackers to gain administrative privileges. This puts the confidentiality and integrity of the stored data as well as the integrity of the device...

NAP Turbo NAS Series Devices File Station Directory Traversal Vulnerability

NAP Turbo NAS Series Devices is a backup software that supports real-time backup, data synchronization and scheduled backup. An input validation vulnerability exists in NAP Turbo NAS Series Devices File Station, which could be exploited by remote attackers to submit a special request to view syst...

Open-Letters Remote PHP Code Injection Vulnerability

Open-Letters is a DAS Direct Attached Storage communication system. Open-Letters suffers from a remote PHP code injection vulnerability. The vulnerability allows attackers to execute arbitrary code...

Shellshock Worm Exploits Bash in QNAP NAS Devices

A worm exploiting network attached storage devices vulnerable to the Bash flaw is scanning the Internet for more victims. The worm opens a backdoor on QNAP devices, but to date it appears the attackers are using the exploit to run a click-fraud scam, in addition to maintaining persistence on owne...

Design/Logic Flaw

IBM Scale Out Network Attached Storage SONAS 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access...

CVE-2014-3045

IBM Scale Out Network Attached Storage SONAS 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access...