CVE-2018-0721

QNAP QTS is affected by CVE-2018-0721, a Buffer Overflow vulnerability that allows a remote attacker to execute arbitrary code. The issue affects QNAP QTS versions 4.2.6 and earlier (build 20180711), 4.3.3 and earlier (build 20180725), and 4.3.4 and earlier (build 20180710). The root cause is a b...

CVE-2018-0721 Security Advisory for Vulnerabilities in QTS

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710...

CVE-2018-0719

CVE-2018-0719 is a QNAP QTS XSS vulnerability in the QTS web interface. Supported affected versions: QTS 4.2.6 and earlier on build 20180711; 4.3.3 and earlier on build 20180725; 4.3.4 and earlier on build 20180710. The issue allows injection of JavaScript by an attacker (no exploit specifics pro...

CVE-2018-0719 Security Advisory for Vulnerabilities in QTS

Cross-site Scripting XSS vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions ...

Cross site scripting

Cross-site Scripting XSS vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions ...

CVE-2018-0719

Cross-site Scripting XSS vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions ...

Cross site scripting

The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting XSS attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and...

CVE-2018-18807

The CVE-2018-18807 issue affects the web application of the TIBCO Statistica component within TIBCO Statistica Server. Affected releases are version 13.4.0 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that could be exploited by an authenticated user to inject web script/HTM...

VMware Fusion 10.x < 10.1.5 / 11.x < 11.0.2 Virtual Network Integer Overflow Vulnerability (VMSA-2018-0030) (macOS)

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.5 or 11.x prior to 11.0.2. It is, therefore, affected by integer overflow vulnerability in the virtual network devices. An attacker with access to a guest system may be able to execute code on the ho...

CVE-2018-19421

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validatesafefile in admin/inc/securityfunctions.php...

homesteadcrossinginc.com XSS vulnerability

Open Bug Bounty ID: OBB-700452 Description| Value ---|--- Affected Website:| homesteadcrossinginc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Synaccess netBooter NP-02x / NP-08x 6.8 Authentication Bypass Vulnerability

Synaccess netBooter NP-02x and NP-08x version 6.8 suffer from an authentication bypass vulnerability due to a missing control check when calling the webNewAcct.cgi script while creating users. This allows an unauthenticated attacker to create an admin user account and bypass authentication giving...

Synaccess netBooter NP-02x / NP-08x 6.8 Authentication Bypass

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vendor: Synaccess Networks Inc. Product web page: https://www.synaccess-net.com Affected version: NP-0201D ver 6.8C NP-02 ver 6.5C NP-02 ver 6.4BC NP-0801D ver 6.4A NP-08 ver 6.10 NP-02 ver 5.53BC Summary: netBooter NP-02B and NP-02BH...

Synaccess netBooter NP-0801DU 7.4 CSRF Add Admin Exploit

Summary netBooter™ NP-0801DU and NP-0801DUH PDUs provide secured remote power source management of 8 independent outlets. Includes true RMS AC current reading and environment temperature monitoring via TCP/IP networks or local direct connection. Description The application interface allows users ...

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass

Summary netBooter™ NP-02B and NP-02BH provide independent control of one or two outlets in a small, robust form factor. Manageable via TCP/IP network or direct serial connection and 1U brackets optional for mounting. Control power to your devices with the ability to fit just about anywhere...

Code injection

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier allows remote authenticated attackers to upload and execute any executable files via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in multiple FXC Inc. network devices Managed Ethernet switch FXC5210/5218/5224 firmware prior to version Ver1.00.22, Managed Ethernet switch FXC5426F firmware prior to version Ver1.00.06, Managed Ethernet switch FXC5428 firmware prior to version Ver1.00.07, Powe...

Hardcoded credentials

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration...

CVE-2018-0682

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier does not properly manage sessions, which allows remote attackers to read/send mail or change the configuration via unspecified vectors...

Hardcoded credentials

Denbun by NEOJAPAN Inc. Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration...