Cross site request forgery (csrf)

A CVE-352 Cross-Site Request Forgery CSRF vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22...

Session fixation

A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4...

Cross site request forgery (csrf)

A CVE-352 Cross-Site Request Forgery CSRF vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22...

CVE-2021-22822

CVE-2021-22822 affects Schneider Electric EVlink family (City EVC1S22P4 / EVC1S7P4, Parking EVW2/EVF2/EVP2PE, Smart Wallbox EVB1A) with all versions prior to R8 V3.4.0.2. It is a CWE-79 Cross-site Scripting issue arising from improper neutralization of input during web page generation, enabling a...

CVE-2021-22822

A CWE-79 Improper Neutralization of Input During Web Page Generation �Cross-site Scripting� vulnerability exists that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the chargi...

CVE-2021-22821

A CWE-918 Server-Side Request Forgery SSRF vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 All...

CVE-2021-22820

CVE-2021-22820 describes a CWE-614Insufficient Session Expiration vulnerability in Schneider Electric EVlink products. Affected are EVlink City (EVC1S22P4/EVC1S7P4), EVlink Parking (EVW2/EVF2/EVP2PE), and EVlink Smart Wallbox (EVB1A), with all versions prior to R8 V3.4.0.2. The issue allows an at...

CVE-2021-22725

A CVE-352 Cross-Site Request Forgery CSRF vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22...

CVE-2021-22724

Schneider Electric EVlink CSRF vulnerability (CVE-2021-22724) affects EVlink City EVC1S22P4/EVC1S7P4, EVlink Parking EVW2/EVF2/EVP2PE, and EVlink Smart Wallbox EVB1A, all versions prior to R8 V3.4.0.2. A Cross-Site Request Forgery exists in the charging-station web server that can allow an attack...

CVE-2021-22724

A CVE-352 Cross-Site Request Forgery CSRF vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22...

VulnCheck KEV: CVE-2018-19943

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code...

VulnCheck KEV: CVE-2018-19953

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code...

MacOS Malware ‘DazzleSpy’ Used in Watering-Hole Attacks

A new family of cyber-espionage malware targeting macOS and delivered via a Safari exploit was used against politically active, pro-democracy residents of Hong Kong, in August watering-hole attacks initially discovered by Google TAG, researchers said on Tuesday. The watering-hole attacks – which...

The vulnerability of the Surveillance Station application for operating systems QTS and network storage devices QNAP, related to the operation’s out-of-buffer behavior in memory, allows a intruder to execute arbitrary code.

The vulnerability of the Surveillance Station application for operating systems QTS and network storage devices from QNAP lies in the fact that the operation data is written beyond the buffer limits in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

CVE-2021-43928

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

QNAP QTS Surveillance Station Buffer Overflow Vulnerability (QSA-21-46)

QNAP QTS Surveillance Station is prone to a stack buffer overflow vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

QNAP NAS Buffer Overflow Vulnerability

QNAP NAS is an accessible and fast storage solution from China Weilian Technology QNAP. The QNAP NAS Surveillance Station suffers from a buffer overflow vulnerability that originates from a boundary error in the software's handling of requests, which can be exploited by an unauthenticated, remote...

CVE-2021-38687

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 64 bit:...

CVE-2021-38687

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 64 bit:...

Stack overflow

A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 64 bit:...