PT-2022-10344

Name of the Vulnerable Software and Affected Versions QNAP Proxy Server versions prior to 1.4.2 Description A cross-site scripting XSS vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code...

CVE-2021-46116

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.TemplateControllerdoInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code...

CVE-2021-46117: Improper Control of Generation of Code

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting XSS bug discovered in the WordPress Email Template Designer – WP HTML Mail, a plugin for designing custom emails. The new vulnerability...

CVE-2022-22530: Undefined Security Weakness

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to inject dangerous content or malicious code which could result in critical information being...

PT-2022-10748

Name of the Vulnerable Software and Affected Versions QNAP QcalAgent versions prior to 1.1.7 Description A cross-site scripting XSS issue has been reported, allowing remote attackers to inject malicious code. Recommendations For versions prior to 1.1.7, update to QcalAgent version 1.1.7 or later ...

CVE-2021-45806

jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code...

PT-2022-12414

Name of the Vulnerable Software and Affected Versions jpress version 4.2.0 Description The issue allows attackers to modify the template and inject malicious code through a function in the admin panel. Recommendations For jpress version 4.2.0, consider disabling access to the admin panel's templa...

CVE-2021-38674: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero...

PT-2022-10747

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.4.1787 build 20210910 QuTS hero versions prior to h4.5.4.1771 build 20210825 QuTScloud versions prior to c4.5.7.1864 Description A cross-site scripting XSS vulnerability has been reported to affect QTS, QuTS hero, and...

PT-2021-22256

Name of the Vulnerable Software and Affected Versions Kazoo Server versions prior to 4.11.20 Description A cross-site scripting XSS vulnerability has been reported to affect QNAP devices running Kazoo Server, allowing remote attackers to inject malicious code. Recommendations For Kazoo Server...

PT-2021-22702

Name of the Vulnerable Software and Affected Versions: invoiceninja affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software fails to properly neutralize user...

Qnap Kazoo Server 跨站脚本漏洞

Qnap Kazoo Server is a server from China Welllink Technology Qnap. QNAP Kazoo Server suffers from a cross-site scripting vulnerability, which can be exploited by attackers to inject malicious code...

KLA12381 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, inject malicious code, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free...

PT-2021-22803

Name of the Vulnerable Software and Affected Versions SquaredUp for SCOM version 5.2.1.6654 Description A DOM-based XSS issue affects the software, potentially allowing attackers to inject malicious code into a user's device if successfully exploited. Recommendations For version 5.2.1.6654, updat...

PT-2021-20471

Name of the Vulnerable Software and Affected Versions: QNAP QmailAgent versions prior to 3.0.2 Description: A cross-site scripting XSS issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For QNAP QmailAgent versions prior to 3.0.2, update to QmailAgent...

Jetbrains JetBrains TeamCity 跨站脚本漏洞

TeamCity is a Java-based build management and continuous integration server from JetBrains. A stored cross-site scripting vulnerability exists in versions of JetBrains TeamCity prior to 2021.1.2. An attacker can exploit this vulnerability to insert malicious code...

OPENSUSE-SU-2021:1443-1 Security update for salt

This update for salt fixes the following issues: - Support querying for JSON data in external sql pillar. - Exclude the full path of a download URL to prevent injection of malicious code. bsc1190265, CVE-2021-21996 This update was imported from the SUSE:SLE-15-SP2:Update update project...

Remote Code Execution (RCE)

aaptjs is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the cmd user input allowing an attacker to inject maliciously craft code via the exec command in the promistify function...

CVE-2021-34355: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10...