CVE-2020-2493 Cross-site Scripting Vulnerability in Multimedia Console

This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later...

CVE-2020-2493

CVE-2020-2493 is an XSS vulnerability in QNAP’s Multimedia Console that allows remote attackers to inject malicious code. The issue affects the Multimedia Console component and has been fixed in Multimedia Console 1.1.5 and later (per QNAP advisory QSA-20-14). The CVE is documented across multipl...

CVE-2020-2493: Improper Neutralization of Input During Web Page Generation

This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later...

PT-2020-15861

Name of the Vulnerable Software and Affected Versions Multimedia Console versions prior to 1.1.5 Description This issue allows remote attackers to inject malicious code through a cross-site scripting vulnerability in Multimedia Console. Recommendations For versions prior to 1.1.5, update to...

QNAP Systems Multimedia Console Cross-Site Scripting Vulnerability

QNAP Systems Multimedia Console is a multimedia controller for centralized management of QTS devices from China Unicom QNAP Systems. A cross-site scripting vulnerability exists in Multimedia Console version 1.1.5 and later versions, which can be exploited to inject malicious code...

QNAP High-Severity Flaws Plague NAS Systems

QNAP Systems is warning of high-severity flaws that plague its top-selling network attached storage NAS devices. If exploited, the most severe of the flaws could allow attackers to remotely take over NAS devices. NAS devices are systems that consist of one or more hard drives that are constantly...

Android Messenger App Still Leaking Photos, Videos

The GO SMS Pro Android app has published two new versions on Google Play since a major security weakness was disclosed in November – but neither fixes the original issue, leaving 100 million users at risk for privacy violations, researchers said. Meanwhile, a raft of exploitation tools have been...

CVE-2020-8539

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

CVE-2020-8539

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

Kia Motors Head Unit Access Control Error Vulnerability

Kia Motors Head Unit is the main unit of a car from the Korean company Kia Kia. The unit is used in the vehicle-machine interaction process. The Kia Motors Head Unit suffers from an Access Control Error vulnerability that can be exploited by an attacker to inject unauthorized commands to trigger...

GO SMS Pro Android App Exposes Private Photos, Videos and Messages

A security weakness discovered in the GO SMS Pro Android app can be exploited to publicly expose media sent using the app, according to researchers. The GO SMS Pro application is a popular messenger app with more than 100 million downloads from the Google Play store. Researchers at Trustwave...

SQL Injection Vulnerability in Multimedia Library of Jiangsu Suqian Jindian Technology Co.

Jiangsu Suqian Jindian Technology Co., Ltd. is a private high-tech company, the company is committed to education informatization, library management informatization and library equipment research and development and production, and provide comprehensive solutions. A SQL injection vulnerability...

Denial of Service Vulnerability in Rexchip Microelectronics Corporation's Rexchip Chip

Focusing on mobile Internet and digital multimedia chip design, Rexchip is a professional SOC solution provider for personal mobile information terminals. A denial-of-service vulnerability exists in Ruixin Microelectronics Corporation's Ruixin Micro chip, which can be exploited by attackers to...

Apple Safari Input Validation Error Vulnerability

Apple Safari is a web browser from Apple, Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Apple Safari versions prior to 13.0.5, which stems from a logic issue where URL schemes may be incorrectly ignored when determining...

Moderate: Red Hat Security Advisory: SDL security update

An update for SDL is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

ALSA-2020:4629 Moderate: libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fixes: libvpx: Double free in ParseContentEncodingEntry in mkvparser.cc CVE-2019-2126 libvpx: Out of bounds read in vp8nor...

Moderate: SDL security update

Simple DirectMedia Layer SDL is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device. Security Fixes: SDL: buffer over-read in IMAADPCMnibble in audio/SDLwave.c CVE-2019-7572 SDL: heap-based buffer overflow in MSADPCMdecode in...

CVE-2020-3852

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

CVE-2020-3852

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...

Input validation

A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website...