CVE-2021-20487: Improper Verification of Cryptographic Signature

IBM Power9 Self Boot EngineSBE could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process...

PT-2021-13988

Name of the Vulnerable Software and Affected Versions: IBM Power9 Self Boot Engine SBE affected versions not specified Description: The issue allows a privileged user to inject malicious code, compromising the integrity of the host firmware by bypassing the host firmware signature verification...

PT-2021-14323

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to trick a legitimate user into clicking a link, potentially injecting malicious code into the Web-Based Management of the switches...

WAGO 跨站脚本漏洞

WAGO is a 750-88x series programmable logic controller from WAGO, Germany. The device is designed specifically for applications in industrial environments where digital algorithms operate electronic systems. A cross-site scripting vulnerability exists in WAGO. The vulnerability stems from a lack ...

CVE-2021-27611: Improper Control of Generation of Code

SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to the local SAP system. The attacker could then get access to data, overwrite them, or execute a denial of service...

CVE-2021-31411: Creation of Temporary File in Directory with Insecure Permissions

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 Vaadin 14.0.3 through Vaadin 14.5.2, 3.0 prior to 6.0 Vaadin 15 prior to 19, and 6.0.0 through 6.0.5 Vaadin 19.0.0 through 19.0.4 allows local users to inject malicious code...

Code execution vulnerability exists in SEACMS (CNVD-2021-26197)

SEACMS is a video-on-demand system designed for webmasters with different needs. A code execution vulnerability exists in SEACMS. An attacker can exploit this vulnerability to inject malicious code, execute system commands, and obtain system privileges...

PT-2021-11101

Name of the Vulnerable Software and Affected Versions: Photo Station versions prior to 6.0.11 Description: This issue allows remote attackers to inject malicious code through a cross-site scripting vulnerability in Photo Station. Recommendations: For versions prior to 6.0.11, update to version...

CVE-2020-2502: Improper Neutralization of Input During Web Page Generation

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later...

PT-2021-11794

Name of the Vulnerable Software and Affected Versions: mbCONNECT24 versions through 2.6.2 mymbCONNECT24 versions through 2.6.2 Description: An issue was discovered allowing an attacker to inject crafted malicious code into the page due to an incomplete XSS filter. Recommendations: For mbCONNECT24...

Cross site scripting

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2020-5343

Name of the Vulnerable Software and Affected Versions QNAP QES versions prior to 2.1.1 Build 20201006 Description This issue is related to a stored cross-site scripting vulnerability that could allow remote attackers to inject malicious code in File Station. The vulnerability is associated with t...

Cross site scripting

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 bui...

CVE-2020-2491: Improper Neutralization of Input During Web Page Generation

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo...

CVE-2020-2496: Improper Neutralization of Input During Web Page Generation

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 a...

PT-2020-15867

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.1.1456 build 20201015 QuTS hero versions prior to h4.5.1.1472 build 20201031 QTS versions prior to 4.4.3.1354 build 20200702 QTS versions prior to 4.3.6.1333 build 20200608 QTS versions prior to 4.3.4.1368 build...

QNAP Systems Multimedia Console Cross-Site Scripting Vulnerability

QNAP Systems Multimedia Console is a multimedia controller for centralized management of QTS devices from China Unicom QNAP Systems. A cross-site scripting vulnerability exists in Multimedia Console version 1.1.5 and later versions, which can be exploited to inject malicious code...

CVE-2020-25538

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server...

CVE-2020-25538

An authenticated attacker can inject malicious code into “lang” parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server. Recent assessments: noraj at May 08, 2021 7:39pm UTC reported: Be careful it...

CVE-2018-19955: Improper Neutralization of Input During Web Page Generation

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10...