Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23304 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:46:38.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` module without permission. A malicious application could call any functions from the `Toybox.SensorHistory` module without the user's consent and disclose potentially private or sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html -
er: - CISA ADP Vulnrichment: References: - https://developer.garmin.com/connect-iq/api-docs/Toybox/SensorHistory.html - https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23304.md
CVE ID: CVE-2023-23305 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:47:22.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. A malicious application embedding specially crafted resources could hijack the execution of the device's firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23305.md
CVE ID: CVE-2023-23306 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T13:48:21.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/Bu
Program Container: - CISA ADP Vulnrichment: References: - https://developer.garmin.com/connect-iq/api-docs/Toybox/Ant/BurstPayload.html#add-instance_function - https://github.com/anvilsecure/garmin-ciq-app-research/blob/main/advisories/CVE-2023-23306.md
CVE ID: CVE-2023-23313 State: PUBLISHED Published: 2023-03-03T00:00:00.000Z Last Updated: 2025-03-07T16:33:57.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's web application management portal. This affects Vigor3910, Vigor1000B, Vigor2962 v4.3.2.1; Vigor2865 and Vigor2866 v4.4.1.0; Vigor2927 v4.4.2.2; and Vigor2915, Vigor2765, Vigor2766, Vigor2135 v4.4.2.0; Vigor2763 v4.4.2.1; Vigor2862 and Vigor2926 v3.9.9.0; Vigor2925 v3.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2. Additional Analyst Not
.9.3; Vigor2952 and Vigor3220 v3.9.7.3; Vigor2133 and Vigor2762 v3.9.6.4; and Vigor2832 v3.9.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.draytek.com/about/security-advisory/cross-site-scripting-vulnerability-%28cve-2023-23313%29/ - https://www.horizonconsulting.com/advisories23-Multiple-XSS-Stored-in-DrayTek-routers-CVE-2023-23313
CVE ID: CVE-2023-23314 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-02T15:36:00.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted .ssh file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/helloxz/zdir/issues/90
CVE ID: CVE-2023-23315 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T17:48:56.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. The method `stripejsValidationModuleFrontController::initContent()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://friends-of-presta.github.io/security-advisories/modules/2023/03/01/stripejs.html
CVE ID: CVE-2023-23324 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T10:28:40.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account. Additional Analyst Notes: - CVE Program Container: References: - http://zumtobel.com - https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/
CVE ID: CVE-2023-23325 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-11-26T20:32:13.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://zumtobel.com - https://yoroi.company/en/research/cve-advisory-partial-disclosure-zumtobel-multiple-vulnerabilities/
CVE ID: CVE-2023-23326 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T18:53:45.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary Javascript into their e-mail address which is executed when an administrator logs into AvantFAX to view the admin dashboard. This may result in stealing an administrator's session cookie and hijacking their session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://avantfax.com - https://github.com/superkojiman/vulnerabilities/blob/master/Avant
ADP Vulnrichment: References: - http://avantfax.com - https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md
CVE ID: CVE-2023-23327 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-03-05T16:49:25.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://avantfax.com - https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md
CVE ID: CVE-2023-23328 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-03-04T21:24:50.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://avantfax.com - https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md
CVE ID: CVE-2023-23330 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-18T21:02:18.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amano.eu/en/parking/xparc/ - https://medium.com/%40saleh.py/amano-xparc-local-file-inclusion-cve-2023-23330-672ae8fbfd1e
CVE ID: CVE-2023-23331 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-03-27T20:28:15.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amano.eu/en/parking/xparc/ - https://0xhunter20.medium.com/how-i-found-my-first-blind-sql-injection-cve-2023-23331-aef103a7f73c
CVE ID: CVE-2023-23333 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T18:37:27.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Timorlover/CVE-2023-23333 - http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html
CVE ID: CVE-2023-23342 State: PUBLISHED Published: 2023-08-10T18:46:23.638Z Last Updated: 2024-10-09T19:32:09.791Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: HCL Software Products: HCL Nomad for web Description: If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106600
CVE ID: CVE-2023-23343 State: PUBLISHED Published: 2023-06-22T21:57:37.702Z Last Updated: 2024-12-05T17:24:32.929Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L) Vendors: HCL Software Products: HCL BigFix OSD Bare Metal Server Description: A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105601
CVE ID: CVE-2023-23344 State: PUBLISHED Published: 2023-06-23T05:02:52.769Z Last Updated: 2024-11-08T16:51:47.525Z Severity: LOW (CVSS 3 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL BigFix WebUI Insights Description: A permission issue in BigFix WebUI Insights site version 14 allows an authenticated, unprivileged operator to access an administrator page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105705
CVE ID: CVE-2023-23346 State: PUBLISHED Published: 2023-08-09T18:52:37.771Z Last Updated: 2024-10-29T19:10:53.328Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: HCL Software Products: HCL DRYiCE MyCloud Description: HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106670
CVE ID: CVE-2023-23347 State: PUBLISHED Published: 2023-08-09T19:01:57.062Z Last Updated: 2024-10-29T19:11:41.912Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: HCL Software Products: HCL DRYiCE iAutomate Description: HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106674
CVE ID: CVE-2023-23348 State: PUBLISHED Published: 2023-07-10T17:06:35.454Z Last Updated: 2024-10-29T19:12:17.621Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Launch Description: HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105978
CVE ID: CVE-2023-23349 State: PUBLISHED Published: 2024-03-22T16:15:55.200Z Last Updated: 2025-04-10T20:10:58.369Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Kaspersky Products: Kaspersky Password Manager for Windows Problem Types: CWE-316 Description: Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must
n form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.kaspersky.com/vulnerability/list-of-advisories/12430#180324
CVE ID: CVE-2023-23354 State: PUBLISHED Published: 2024-12-19T01:39:27.208Z Last Updated: 2024-12-24T00:40:55.260Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: QNAP Systems Inc. Products: QuLog Center Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 2023/03/01 ) and later QuLog Cent
ing versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 2023/03/01 ) and later QuLog Center 1.3.1.645 ( 2023/02/22 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-13
CVE ID: CVE-2023-23355 State: PUBLISHED Published: 2023-03-29T04:02:59.944Z Last Updated: 2025-02-12T16:49:09.437Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud, QES Problem Types: CWE-77, CWE-78 Description: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0
n the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-10
CVE ID: CVE-2023-23356 State: PUBLISHED Published: 2024-12-19T01:39:15.645Z Last Updated: 2024-12-24T00:41:02.334Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: QNAP Systems Inc. Products: QuFirewall Problem Types: CWE-77, CWE-78 Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QuFirewall 2.3.3 ( 2023/03/27 ) and later and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
irewall 2.3.3 ( 2023/03/27 ) and later and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-14
CVE ID: CVE-2023-23357 State: PUBLISHED Published: 2024-12-19T01:39:02.809Z Last Updated: 2024-12-24T00:41:08.605Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: QNAP Systems Inc. Products: QuLog Center Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 2023/03/01 ) and later
the following versions: QuLog Center 1.5.0.738 ( 2023/03/06 ) and later QuLog Center 1.4.1.691 ( 2023/03/01 ) and later QuLog Center 1.3.1.645 ( 2023/02/22 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-16
CVE ID: CVE-2023-23362 State: PUBLISHED Published: 2023-09-22T03:27:19.075Z Last Updated: 2024-09-24T18:12:15.044Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4
230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-18
CVE ID: CVE-2023-23363 State: PUBLISHED Published: 2023-09-22T03:50:42.730Z Last Updated: 2024-09-24T18:10:34.196Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-120 Description: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later Add
r QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-25
CVE ID: CVE-2023-23364 State: PUBLISHED Published: 2023-09-22T03:51:02.028Z Last Updated: 2024-09-24T18:09:22.705Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Multimedia Console Problem Types: CWE-120 Description: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later Additional Analyst Notes: - CVE Program Co
.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-29
CVE ID: CVE-2023-23365 State: PUBLISHED Published: 2023-10-06T16:33:40.264Z Last Updated: 2024-09-19T15:20:40.296Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: Music Station Problem Types: CWE-22, CWE-552 Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
5.3.22 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-28
CVE ID: CVE-2023-23366 State: PUBLISHED Published: 2023-10-06T16:34:01.529Z Last Updated: 2024-09-19T15:20:25.517Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: Music Station Problem Types: CWE-22, CWE-552 Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Music Station 5.3.22 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
CVE ID: CVE-2023-23367 State: PUBLISHED Published: 2023-11-10T14:49:46.924Z Last Updated: 2025-02-26T21:27:17.842Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later Additional Ana
6 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-24
CVE ID: CVE-2023-23368 State: PUBLISHED Published: 2023-11-03T16:34:24.216Z Last Updated: 2025-02-27T20:34:38.708Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build
later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-31