CVE-2025-54168 QuLog Center

A cross-site scripting XSS vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2025-57706

CVE-2025-57706 is a QNAP File Station 5 XSS vulnerability. It stems from insufficient filtering/escaping of user-supplied data, enabling an attacker with a valid account to read application data or bypass security checks. Affected software: File Station 5; vulnerable component/content handling le...

CVE-2025-57706 File Station 5

A cross-site scripting XSS vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: File...

CVE-2025-58465

The CVE-2025-58465 entry describes a cross-site scripting (XSS) vulnerability in QNAP Download Station. A remote attacker who gains a user account could exploit the flaw to bypass security mechanisms or read application data. Affected software is Download Station; vulnerable component/process is ...

CVE-2025-58465 Download Station

A cross-site scripting XSS vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions:...

CVE-2025-58465 Download Station

A cross-site scripting XSS vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions:...

QNAP Systems QuLog Center 跨站脚本漏洞

QNAP Systems QuLog Center is a report field for China-based QNAP Systems that logs events reported by the system. A cross-site scripting vulnerability exists in QNAP Systems QuLog Center version 1.8.2.923, which stems from susceptibility to cross-site scripting attacks that could result in...

PT-2025-45432

Name of the Vulnerable Software and Affected Versions QuLog Center versions prior to 1.8.2.923 Description A cross-site scripting XSS issue exists in QuLog Center. Successful exploitation by a remote attacker who has obtained administrator privileges could allow them to bypass security features o...

QNAP Notification Center 跨站脚本漏洞

QNAP Notification Center is a system event alert and notification software from Taiwan, China-based QNAP Technology QNAP. A cross-site scripting vulnerability exists in QNAP Notification Center versions 2.1.0.3443, 1.9.2.3163, and 3.0.0.3466, which stems from susceptibility to cross-site scriptin...

PT-2025-45431

Name of the Vulnerable Software and Affected Versions Notification Center versions prior to 2.1.0.3443 Notification Center versions prior to 1.9.2.3163 Notification Center versions prior to 3.0.0.3466 Description A cross-site scripting XSS issue exists in Notification Center. An attacker who...

QNAP Download Station 跨站脚本漏洞

QNAP Download Station is a web-based download tool from Taiwan, China-based QNAP Technology QNAP. A cross-site scripting vulnerability exists in QNAP Download Station, which stems from susceptibility to cross-site scripting attacks that could result in bypassing security mechanisms or reading...

PT-2025-45437

Name of the Vulnerable Software and Affected Versions Download Station versions prior to 5.10.0.304 Description A cross-site scripting XSS issue exists in Download Station. A remote attacker who has obtained a user account can potentially exploit this issue to circumvent security measures or acce...

tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve

A flaw was found in Apache Tomcat's rewrite rule processing component. This vulnerability allows security constraints to be bypassed via specially crafted HTTP requests when specific, uncommon rewrite rule configurations are in use...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following in the handling of procfs file writes. An attacker can cause arbitrary writes to sensitive files or trigger a denial of service by redirecting write operations through race conditions and...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following in the handling of procfs file writes. An attacker can cause arbitrary writes to sensitive files or trigger a denial of service by redirecting write operations through race conditions and...

ROS-20251105-06

The vulnerability of Microsoft .NET Framework, .NET software platforms, and Microsoft Visual Studio software development tool is related to insufficiently strong data encryption. Microsoft Visual Studio software development tool is related to insufficiently strong data encryption. Exploitation...

EUVD-2025-37013

Byaidu PDFMathTranslate vulnerable to open redirect...

Relative Path Traversal

Apache Tomcat is vulnerable to Path Traversal. The vulnerability is due to the rewritten URL being normalized before it was decoded. This allows an attackers to manipulate the request URI and, if PUT is enabled, upload malicious files to bypass security constraints protecting /WEB-INF/ and...

CVE-2025-50736

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2025-26888)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a security bypass vulnerability caused by an integer overflow in the Graphics:Canvas2D component. An attacker could exploit this vulnerability to cause a sandbox escape...