PT-2021-20469

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 5.4.10 Photo Station versions prior to 5.7.13 Photo Station versions prior to 6.0.18 Description: A cross-site scripting XSS issue has been reported, allowing remote attackers to inject malicious code...

PT-2021-7221

Name of the Vulnerable Software and Affected Versions MCE Systems affected versions not specified Description The issue is related to the transmission of data in plain text in the MCE Systems mobile device lifecycle management system's WebView component. This could allow an attacker to implement ...

PT-2021-7244

Name of the Vulnerable Software and Affected Versions MCE Systems affected versions not specified Description The issue is related to the categoryId parameter in the WebView component of the MCE Systems mobile device lifecycle management system. It involves errors in link processing before...

PT-2021-7240

Name of the Vulnerable Software and Affected Versions MCE Systems affected versions not specified Description The issue is related to errors in link processing before accessing a file in the MCE Systems mobile device lifecycle management system's WebView component. Exploitation of this issue may...

PT-2021-20468

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 6.0.18 Description: A cross-site scripting XSS issue has been reported, allowing remote attackers to inject malicious code. Recommendations: For versions prior to 6.0.18, update to Photo Station 6.0.18 or later...

CVE-2021-34354: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18...

Mail.ru: Subdomain Takeover

Hi team, Actually team this bug is similar to my previous bug which I submitted-██████ Issue details:- Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82428)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from the lack of validation of input data in Eyoucms. An attacker could use this vulnerability to inject malicious cod...

WooCommerce Pricing Plugin Allows Malicious Code-Injection

A pair of security vulnerabilities in the WooCommerce Dynamic Pricing and Discounts plugin from Envato could allow unauthenticated attackers to inject malicious code into websites running unpatched versions. This can result in a variety of attacks, including website redirections to phishing pages...

CVE-2020-36196

A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0...

PT-2021-11962

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202 QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414 Description: A reported issue allows attackers to inject malicious code. This is achieved through an XS...

CVE-2020-36196: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0...

PT-2021-11963

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. QuLog Center versions prior to 1.2.0 Description: A stored XSS issue has been reported, allowing attackers to inject malicious code. Recommendations: For versions prior to 1.2.0, update to version 1.2.0 or later to resolve t...

CVE-2020-36194: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to...

QNAP QTS XSS Vulnerability (QSA-21-32)

QNAP QTS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

CVE-2021-22439

Huawei AnyOffice is affected by a deserialization vulnerability in version V200R006C10. The issue allows an attacker to craft a specific request to achieve remote code execution and take control of the device. Root cause is deserialization of untrusted data, with exploitation described as feasibl...

CVE-2021-22439: Deserialization of Untrusted Data

There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device...

Cross-site Scripting (XSS)

qiita-markdown is vulnerable to cross site scripting. An attacker is able to inject and execute malicious code via a crafted gist link...

CVE-2021-32700

Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored...

Ballerina 访问控制错误漏洞

Ballerina is an open source programming language platform. Ballerina suffers from a security vulnerability that can be exploited by an attacker to replace or modify packages retrieved from BC, allowing malicious code to be injected into the Ballerina executable...