Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-7148 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens." Additional Analyst Notes: - CVE
g ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens." Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=24085
CVE ID: CVE-2019-7149 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://sourceware.org/bugzilla/show_bug.cgi?id=24102 - https://usn.ubuntu.com/4012-1/ - https://access.
msg00036.html - https://sourceware.org/bugzilla/show_bug.cgi?id=24102 - https://usn.ubuntu.com/4012-1/ - https://access.redhat.com/errata/RHSA-2019:2197 - https://access.redhat.com/errata/RHSA-2019:3575
CVE ID: CVE-2019-7150 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=24103 - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - htt
sourceware.org/bugzilla/show_bug.cgi?id=24103 - https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html - https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html - https://usn.ubuntu.com/4012-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html - https://access.redhat.com/errata/RHSA-2019:2197 - https://access.redhat.com/errata/RHSA-2019:3575 - https://lists.debian.org/debian-lts-announce/2021/10/msg00030.html
CVE ID: CVE-2019-7151 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in wasm::Module::getFunctionOrNull in wasm/wasm.cpp in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebAssembly/binaryen/issues/1881
CVE ID: CVE-2019-7152 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebAssembly/binaryen/issues/1880
CVE ID: CVE-2019-7153 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference was discovered in wasm::WasmBinaryBuilder::processFunctions() in wasm/wasm-binary.cpp (when calling wasm::WasmBinaryBuilder::getFunctionIndexName) in Binaryen 1.38.22. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm-opt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebAssembly/binaryen/issues/1879
CVE ID: CVE-2019-7154 State: PUBLISHED Published: 2019-01-29T00:00:00 Last Updated: 2024-08-04T20:38:33.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: The main function in tools/wasm2js.cpp in Binaryen 1.38.22 has a heap-based buffer overflow because Emscripten is misused, triggering an error in cashew::JSPrinter::printAst() in emscripten-optimizer/simple_ast.h. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WebAssembly/binaryen/issues/1876
CVE ID: CVE-2019-7155 State: PUBLISHED Published: 2019-04-16T21:47:56 Last Updated: 2024-08-04T20:38:33.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their privileges within the project are different from the group. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ - https://gitlab.com/gitlab-org/
- https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/42726
CVE ID: CVE-2019-7156 State: PUBLISHED Published: 2019-01-29T08:00:00 Last Updated: 2024-08-04T20:38:33.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libdoc through 2019-01-28, calcFileBlockOffset in ole.c allows division by zero. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106813 - https://github.com/uvoteam/libdoc/issues/5
CVE ID: CVE-2019-7158 State: PUBLISHED Published: 2019-06-17T19:03:42 Last Updated: 2024-08-04T20:38:33.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.10.0 and earlier has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/
CVE ID: CVE-2019-7159 State: PUBLISHED Published: 2019-06-18T12:24:18 Last Updated: 2024-08-04T20:38:33.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.10.1 and earlier allows Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com/
CVE ID: CVE-2019-7160 State: PUBLISHED Published: 2019-01-29T16:00:00 Last Updated: 2024-08-04T20:38:33.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/50
CVE ID: CVE-2019-7161 State: PUBLISHED Published: 2019-03-18T20:39:46.000Z Last Updated: 2025-05-30T16:01:16.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/ - https://www.manageengine.com/products/self-service-password/release-notes.html - https://www.excellium-services.com/cert-xlm-advisory - https://cds.thalesgroup.com/en/tcs-cert/CVE-201
ease-notes.html - https://www.excellium-services.com/cert-xlm-advisory - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7161
CVE ID: CVE-2019-7162 State: PUBLISHED Published: 2019-12-31T14:10:58.000Z Last Updated: 2025-05-30T16:01:21.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162/ - https://www.excellium-services.com/cert-xlm-advisory - https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7162
CVE ID: CVE-2019-7163 State: PUBLISHED Published: 2019-08-02T20:56:25 Last Updated: 2024-08-04T20:38:33.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthenticated user to have access to the web interface without knowing the administrator's password. Additional Analyst Notes: - CVE Program Container: References: - https://rhaidiz.net/2019/02/27/dribble-router-vulns-dlink-alcatel-cve-2019-6969-cve-2019-6968-cve-2019-7163/
CVE ID: CVE-2019-7164 State: PUBLISHED Published: 2019-02-20T00:00:00 Last Updated: 2024-08-04T20:38:33.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html - https://access.redhat.com/errata/RHSA-2019:0984 - https://access.redhat.com/errata/RHSA-2019:0981 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html - http://lists.opensuse.org/opensuse-security
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://github.com/sqlalchemy/sqlalchemy/issues/4481 - https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
CVE ID: CVE-2019-7165 State: PUBLISHED Published: 2019-07-03T17:25:07 Last Updated: 2024-08-04T20:38:33.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2019-7165 - https://www.dosbox.com - https://lists.debian.org/debian-lts-announce/2019/07/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYV27Z3QZTDHUZJLW3LDJYO7HBVIMJ5F/ - https://www.debian.org/security/2019/dsa-4478 - https://seclists.org/bugtraq/2019/Jul/14 - http://lis
3LDJYO7HBVIMJ5F/ - https://www.debian.org/security/2019/dsa-4478 - https://seclists.org/bugtraq/2019/Jul/14 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00053.html
CVE ID: CVE-2019-7167 State: PUBLISHED Published: 2019-03-27T01:37:40 Last Updated: 2024-08-04T20:38:33.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into acce
atement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction. Additional Analyst Notes: - CVE Program Container: References: - http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/ - https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/ - https://github.com/JinBean/CVE-Extension
CVE ID: CVE-2019-7168 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-16T21:04:35.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/886
CVE ID: CVE-2019-7169 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-16T23:16:28.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/888
CVE ID: CVE-2019-7170 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-16T19:19:55.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/890
CVE ID: CVE-2019-7171 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-16T16:13:47.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/887
CVE ID: CVE-2019-7172 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-17T01:12:11.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/atutor/ATutor/issues/164
CVE ID: CVE-2019-7173 State: PUBLISHED Published: 2019-01-29T18:00:00Z Last Updated: 2024-09-17T00:20:34.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/croogo/croogo/issues/889
CVE ID: CVE-2019-7174 State: PUBLISHED Published: 2019-04-09T17:58:27 Last Updated: 2024-08-04T20:38:33.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and movefile.php (aka Move File) operations. Additional Analyst Notes: - CVE Program Container: References: - https://alicangonullu.biz/konu/2
CVE ID: CVE-2019-7175 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T20:38:33.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/commit/1e6a3ace073c9ec9c71e439c111d23c6e66cb6ae - https://github.com/ImageMagick/ImageMagick/issues/1450 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4
se-security-announce/2019-05/msg00006.html - https://usn.ubuntu.com/4034-1/ - https://www.debian.org/security/2020/dsa-4712
CVE ID: CVE-2019-7176 State: PUBLISHED Published: 2019-09-09T20:02:30 Last Updated: 2024-08-04T20:38:33.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/51332
CVE ID: CVE-2019-7177 State: PUBLISHED Published: 2020-09-25T03:26:24 Last Updated: 2024-08-04T20:38:33.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/release_notes.htm - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2019-7178 State: PUBLISHED Published: 2020-09-25T03:26:59 Last Updated: 2024-08-04T20:38:33.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/release_notes.htm - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2019-7181 State: PUBLISHED Published: 2019-05-09T14:57:52 Last Updated: 2024-08-04T20:38:33.543Z Vendors: n/a Products: myQNAPcloud Connect Problem Types: Buffer Overflow Description: Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the program. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152570/QNAP-myQNAPcloud-Connect-1.3.4.0317-Username-Password-Denial-Of-Service.html - https://www.exploit-db.com/exploits/46733/ - https://www.qnap.com/zh-tw/security-advisory/nas-201905-09
CVE ID: CVE-2019-7183 State: PUBLISHED Published: 2019-12-05T16:41:13 Last Updated: 2024-08-04T20:38:33.537Z Vendors: n/a Products: QNAP NAS devices Problem Types: Improper Link Resolution Description: This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE ID: CVE-2019-7184 State: PUBLISHED Published: 2019-12-05T16:45:14 Last Updated: 2024-08-04T20:38:33.496Z Vendors: n/a Products: QNAP NAS devices running Video Station Problem Types: Cross-site Scripting (XSS) Description: This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE ID: CVE-2019-7185 State: PUBLISHED Published: 2019-12-05T16:48:20 Last Updated: 2024-08-04T20:38:33.501Z Vendors: n/a Products: QNAP NAS devices running Music Station Problem Types: Cross-site Scripting (XSS) Description: This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-27
CVE ID: CVE-2019-7192 State: PUBLISHED Published: 2019-12-05T16:17:29.000Z Last Updated: 2025-10-21T23:35:57.175Z Vendors: n/a Products: QNAP NAS devices running Photo Station Problem Types: Improper Access Control Description: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 - http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE ID: CVE-2019-7193 State: PUBLISHED Published: 2019-12-05T16:22:19.000Z Last Updated: 2025-10-21T23:35:57.020Z Vendors: n/a Products: QNAP NAS devices Problem Types: Improper Input Validation Description: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 - http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE ID: CVE-2019-7194 State: PUBLISHED Published: 2019-12-05T16:30:53.000Z Last Updated: 2025-10-21T23:35:56.883Z Vendors: n/a Products: QNAP NAS devices running Photo Station Problem Types: External Control of File Name or Path Description: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 - http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.
y/nas-201911-25 - http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
CVE ID: CVE-2019-7195 State: PUBLISHED Published: 2019-12-05T16:34:38.000Z Last Updated: 2025-10-21T23:35:56.749Z Vendors: n/a Products: QNAP NAS devices running Photo Station Problem Types: External Control of File Name or Path Description: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 - http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.
CVE ID: CVE-2019-7197 State: PUBLISHED Published: 2019-12-04T16:45:00 Last Updated: 2024-08-04T20:38:33.491Z Vendors: n/a Products: QNAP NAS devices Problem Types: Stored XSS Description: A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201911-26