Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44025 State: PUBLISHED Published: 2021-11-19T03:47:48 Last Updated: 2024-08-04T04:10:17.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/1000156 - https://github.com/roundcube/roundcubemail/issues/8193 - https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a - https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 - https://lists.fedoraproject.org/a
//github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/ - https://www.debian.org/security/2021/dsa-5013 - https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html
CVE ID: CVE-2021-44026 State: PUBLISHED Published: 2021-11-19T03:47:27.000Z Last Updated: 2025-10-21T23:25:24.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/1000156 - https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1 - https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y
7808a7296681dcfa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO/ - https://www.debian.org/security/2021/dsa-5013 - https://lists.debian.org/debian-lts-announce/2021/12/msg00004.html
CVE ID: CVE-2021-44028 State: PUBLISHED Published: 2021-12-22T05:03:39 Last Updated: 2024-08-04T04:10:17.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285. Additional Analyst Notes: - CVE Program Container: References: - https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE ID: CVE-2021-44029 State: PUBLISHED Published: 2021-12-22T05:08:42 Last Updated: 2024-08-04T04:10:17.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation. Additional Analyst Notes: - CVE Program Containe
feature in more current versions of ASP.NET AJAX prevents exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE ID: CVE-2021-44030 State: PUBLISHED Published: 2021-12-22T05:07:42 Last Updated: 2024-08-04T04:10:17.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery. Additional Analyst Notes: - CVE Program Container: References: - https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE ID: CVE-2021-44031 State: PUBLISHED Published: 2021-12-22T05:08:18 Last Updated: 2024-08-04T04:10:17.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}. Additional Analyst Notes: - CVE Program Container: References: - https://support.quest.com/kace-desktop-authority/kb/336098/quest-response-to-desktop-authority-vulnerabilities-prior-to-11-2
CVE ID: CVE-2021-44032 State: PUBLISHED Published: 2022-03-07T04:06:52 Last Updated: 2024-08-04T04:10:17.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Omada SDN Software Controller before 5.0.15 does not check if the authentication method specified in a connection request is allowed. An attacker can bypass the captive portal authentication process by using the downgraded "no authentication" method, and access the protected network. For example, the attacker can simply set window.authType=0 in client-side JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://www.tp-link.com/us/security - https://www.tp-link.com/us/omada-sdn/ - https://g
Program Container: References: - https://www.tp-link.com/us/security - https://www.tp-link.com/us/omada-sdn/ - https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_CVE-2021-44032_Kevin.md
CVE ID: CVE-2021-44033 State: PUBLISHED Published: 2021-11-19T04:37:57 Last Updated: 2024-08-04T04:10:17.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://ionic.io/docs/identity-vault/changelog - http://seclists.org/fulldisclosure/2021/Nov/41 - http://packetstormsecurity.com/files/165027/Ionic-Identity-Vault-5.0.4-PIN-Unlock-Lockout-Bypass.html
CVE ID: CVE-2021-44035 State: PUBLISHED Published: 2021-12-17T15:17:50.000Z Last Updated: 2025-05-30T16:01:48.154Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://www.wolterskluwer.com/en/solutions/teammate - https://excellium-services.com/cert-xlm-advisory/CVE-2021-44035 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-44035
CVE ID: CVE-2021-44036 State: PUBLISHED Published: 2021-11-19T16:50:34 Last Updated: 2024-08-04T04:10:17.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-059.txt - https://teampasswordmanager.com/docs/changelog/#10.135.236
CVE ID: CVE-2021-44037 State: PUBLISHED Published: 2021-11-19T16:57:22 Last Updated: 2024-08-04T04:10:17.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning. Additional Analyst Notes: - CVE Program Container: References: - https://teampasswordmanager.com/docs/changelog/#10.135.236 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-060.txt
CVE ID: CVE-2021-44038 State: PUBLISHED Published: 2021-11-19T18:29:55 Last Updated: 2024-08-04T04:10:17.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1191890 - https://github.com/Quagga/quagga/releases
CVE ID: CVE-2021-44040 State: PUBLISHED Published: 2022-03-23T14:05:15 Last Updated: 2024-08-04T04:10:17.217Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6 - https://www.debian.org/security/2022/dsa-5153
CVE ID: CVE-2021-44041 State: PUBLISHED Published: 2021-12-14T17:49:48 Last Updated: 2024-08-04T04:10:17.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path. Additional Analyst Notes: - CVE Program Container: References: - https://docs.uipath.com/robot/docs/uipath-assistant - https://docs.uipath.com/robot/docs/release-notes-2021-10-4
CVE ID: CVE-2021-44042 State: PUBLISHED Published: 2021-12-14T17:49:45 Last Updated: 2024-08-04T04:10:17.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application. Additional Analyst Notes: - CVE Program Container: References: - https://docs.uipath.co
ext of the Electron application. Additional Analyst Notes: - CVE Program Container: References: - https://docs.uipath.com/robot/docs/uipath-assistant - https://docs.uipath.com/robot/docs/release-notes-2021-10-4
CVE ID: CVE-2021-44043 State: PUBLISHED Published: 2021-12-14T17:50:33 Last Updated: 2024-08-04T04:10:17.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization. Additional Analy
hen allows the file to be stored and retrieved from the server by other users in the same organization. Additional Analyst Notes: - CVE Program Container: References: - https://docs.uipath.com/robot/docs/uipath-assistant - https://docs.uipath.com/apps/v2021.10/docs/2021-10-1
CVE ID: CVE-2021-44044 State: PUBLISHED Published: 2021-12-05T20:29:48 Last Updated: 2024-08-04T04:10:17.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write vulnerability exists when reading a JPG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing JPG files. Crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-44045 State: PUBLISHED Published: 2021-12-05T20:30:10 Last Updated: 2024-08-04T04:10:17.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation for the XFAT sectors count can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/securi
CVE ID: CVE-2021-44046 State: PUBLISHED Published: 2021-12-05T20:30:39 Last Updated: 2024-08-04T04:10:17.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write vulnerability exists when reading U3D files in Open Design Alliance PRC SDK before 2022.11. An unchecked return value of a function (verifying input data from a U3D file) leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-44047 State: PUBLISHED Published: 2021-12-05T20:30:59 Last Updated: 2024-08-04T04:10:17.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-44048 State: PUBLISHED Published: 2021-12-05T20:31:56 Last Updated: 2024-08-04T04:10:17.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write vulnerability exists when reading a TIF file using Open Design Alliance (ODA) Drawings Explorer before 2022.11. The specific issue exists after loading TIF files. Crafted data in a TIF file can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2021-44049 State: PUBLISHED Published: 2022-01-15T14:28:51 Last Updated: 2024-08-04T04:10:17.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyberark.com/product-security/ - https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM-onprem/Latest/en/Content/Release%20Notes/RN-WhatsNew.htm - https://www.cyberark.com/ca21-34/ - https://hencohen10.medium.com/cyberark-endpoint-manager-local-privilege-escalation-
https://www.cyberark.com/ca21-34/ - https://hencohen10.medium.com/cyberark-endpoint-manager-local-privilege-escalation-cve-2021-44049-67cd5e62c3d2
CVE ID: CVE-2021-44050 State: PUBLISHED Published: 2021-12-02T18:18:41 Last Updated: 2024-08-04T04:10:17.311Z Vendors: n/a Products: CA Network Flow Analysis (NFA) Problem Types: SQL injection Description: CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient input validation, that could potentially allow an authenticated user to access sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/security-advisories/CA20211201-01-Security-Notice-for-CA-Network-Flow-Analysis/19689 - http://seclists.org/fulldisclosure/2021/Dec/0
CVE ID: CVE-2021-44051 State: PUBLISHED Published: 2022-05-05T16:50:20.575960Z Last Updated: 2024-09-16T17:43:45.081Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QuTScloud, QuTS hero, QTS Problem Types: CWE-77 Description: A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later A
QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-16
CVE ID: CVE-2021-44052 State: PUBLISHED Published: 2022-05-05T16:50:22.030865Z Last Updated: 2024-09-16T22:56:12.420Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: QuTScloud, QuTS hero, QTS Problem Types: CWE-59 Description: An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS h
he contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-16
CVE ID: CVE-2021-44053 State: PUBLISHED Published: 2022-05-05T16:50:23.491221Z Last Updated: 2024-09-16T19:31:09.468Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build
d QuTScloud: QTS 4.5.4.1991 build 20220329 and later QTS 5.0.0.1986 build 20220324 and later QuTS hero h5.0.0.1986 build 20220324 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTScloud c5.0.1.1949 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-16
CVE ID: CVE-2021-44054 State: PUBLISHED Published: 2022-05-05T16:50:24.966011Z Last Updated: 2024-09-16T16:57:37.609Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QuTScloud, QuTS hero, QTS Problem Types: CWE-601 Description: An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero
QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-16
CVE ID: CVE-2021-44055 State: PUBLISHED Published: 2022-05-05T16:50:26.331313Z Last Updated: 2024-09-17T00:06:46.037Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: Video Station Problem Types: CWE-862 Description: An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later Additional Analyst Notes: - CVE Program Container: Refe
s of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-14
CVE ID: CVE-2021-44056 State: PUBLISHED Published: 2022-05-05T16:50:27.692351Z Last Updated: 2024-09-17T03:08:09.720Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Video Station Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later Additional Analyst Notes: - CVE Program Container: R
later Video Station 5.3.13 and later Video Station 5.1.8 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-14
CVE ID: CVE-2021-44057 State: PUBLISHED Published: 2022-05-05T16:50:29.108526Z Last Updated: 2024-09-16T22:56:14.146Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later Addit
2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-15
CVE ID: CVE-2021-44076 State: PUBLISHED Published: 2022-09-15T12:35:32 Last Updated: 2024-08-04T04:10:17.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with access to the administration panel, to perform Stored Cross-Site Scripting (XSS). The payload can be executed in multiple scenarios, for example when the user's page appears in the Most Visited section of the page. Additional Analyst Notes: - CVE Program Container: References: - https://www.crushftp.com/ - https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp
ences: - https://www.crushftp.com/ - https://labs.nettitude.com/blog/cve-2021-44076-cross-site-scripting-xss-in-crushftp/