QNAP Systems QTS and QuTS hero security vulnerabilities

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems.QNAP Systems QTS is an operating system used by entry to mid-level QNAP NAS.QNAP Systems QuTS hero is an operating system. A security vulnerability exists in QNAP Systems QTS prior to version...

UBUNTU-CVE-2024-21910

TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser...

CVE-2022-46487

Improper initialization of x87 and SSE floating-point configuration registers in the sconeentry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel...

PT-2023-31277 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to 5.16.5 Description: The issue is related to improper authentication in some Zoom clients, which may allow an authenticated user to conduct a denial of service via network access. Recommendations: For versions prior to...

PT-2023-8130

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR models running QVR Firmware versions prior to 5.0.0 Description An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models. If exploited, the vulnerability could allow authenticated users to...

CVE-2023-43065

Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to obtain escalated privileges...

AZL-31565 CVE-2023-45862 affecting package kernel for versions less than 5.15.135.1-2

An issue was discovered in drivers/usb/storage/eneub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation...

AZL-31266 CVE-2023-39192 affecting package kernel for versions less than 5.15.135.1-2

A flaw was found in the Netfilter subsystem in the Linux kernel. The xtu32 module did not validate the fields in the xtu32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a cra...

CVE-2023-4951

A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2...

AZL-28055 CVE-2022-48554 affecting package file for versions less than 5.40-3

File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project...

AZL-27675 CVE-2023-3611 affecting package kernel for versions less than 5.15.122.1-2

An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We...

PT-2023-24689 · Zoom · Zoom Rooms For Windows

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Windows versions prior to 5.15.0 Description: The issue is related to an insecure temporary file in the installer, which may allow an authenticated user to enable an escalation of privilege via local access. Recommendations: Fo...

SUSE CVE-2013-2110

Heap-based buffer overflow in the phpquotprintencode function in ext/standard/quotprint.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted argument to the quotedprintableenco...

CVE-2023-2820

An information disclosure vulnerability in the faye endpoint in Proofpoint Threat Response / Threat Response Auto-Pull PTR/TRAP could be used by an attacker on an adjacent network to obtain credentials to integrated services via a man-in-the-middle position or cryptanalysis of the session traffic...

CVE-2023-26294

Previous versions of HP Device Manager prior to HPDM 5.0.10 could potentially allow command injection and/or elevation of privileges...

PT-2023-3580

Name of the Vulnerable Software and Affected Versions: Qt versions prior to 5.15.15 Qt versions 6.x prior to 6.2.9 Qt versions 6.3.x through 6.5.x prior to 6.5.1 Description: The issue is related to a buffer overflow in the QTextLayout component of the Qt framework when rendering a SVG file with ...

Intel DCM software 安全漏洞

Intel DCM software is an application from Intel Corporation USA. A security vulnerability exists in Intel DCM software versions prior to 5.0.1, which arises from insufficiently protected credentials. An attacker could exploit the vulnerability to cause information disclosure...

Western Digital My Cloud 命令注入漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud OS 5 prior to version 5.26.119, which stems from a command injection vulnerability that could allow an attacker to execute code against vulnerable CGI file...

Acronis Cyber Infrastructure 安全漏洞

Acronis Cyber Infrastructure is a simple, efficient and secure solution for edge workloads from Acronis Switzerland. A security vulnerability exists in versions prior to Acronis Cyber Infrastructure 5.2.0-135, which stems from the disclosure of sensitive information due to a CORS misconfiguration...

AZL-26300 CVE-2023-26463 affecting package strongswan for versions less than 5.9.10-1

strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrust...