deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52122
Published: 2024-01-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-46839
Published: 2024-01-05
Description: Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-7-1-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-7-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2023-52143
Published: 2024-01-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://patchstack.com/database/vulnerability/wp-stripe-checkout/wordpress-wp-stripe-checkout-plugin-1-2-2-37-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-stripe-checkout/wordpress-wp-stripe-checkout-plugin-1-2-2-37-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-52146
Published: 2024-01-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://patchstack.com/database/vulnerability/404-solution/wordpress-404-solution-plugin-2-33-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/404-solution/wordpress-404-solution-plugin-2-33-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-52148
Published: 2024-01-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-30-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-30-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-52151
Published: 2024-01-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin.This issue affects Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin: from n/a through 5.1.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/uncanny-automator/wordpress-uncanny-automator-plugin-5-1-0-2-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/uncanny-automator/wordpress-uncanny-automator-plugin-5-1-0-2-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2023-52124
Published: 2024-01-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-expand-tabs-free/wordpress-wp-tabs-responsive-tabs-plugin-for-wordpress-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-expand-tabs-free/wordpress-wp-tabs-responsive-tabs-plugin-for-wordpress-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52125
Published: 2024-01-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/iframe/wordpress-iframe-plugin-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/iframe/wordpress-iframe-plugin-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-52126
Published: 2024-01-05
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/send-users-email/wordpress-send-users-email-plugin-1-4-3-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/send-users-email/wordpress-send-users-email-plugin-1-4-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-0246
Published: 2024-01-05
Description: A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27"()%26%25<zzz><ScRiPt>alert(document.domain)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.249759; https://vuldb.com/?id.249759; https://vuldb.com/?ctiid.249759
CVE: CVE-2023-34321
Published: 2024-01-05
Description: Arm provides multiple helpers to clean & invalidate the cache
for a given region.  This is, for instance, used when allocating
guest memory to ensure any writes (such as the ones during scrubbing)
have reached memory before handing over the page to a guest.

Unfortunately, the arithmetics in the helpers can overflow and would
then result to skip the cache cleaning/invalidation.  Therefore there
is no guarantee when all the writes will reach the memory.

CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-119
References: https://xenbits.xenproject.org/xsa/advisory-437.html; http://xenbits.xen.org/xsa/advisory-437.html; https://xenbits.xenproject.org/xsa/advisory-437.html
CVE: CVE-2023-34322
Published: 2024-01-05
Description: For migration as well as to work around kernels unaware of L1TF (see
XSA-273), PV guests may be run in shadow paging mode.  Since Xen itself
needs to be mapped when PV guests run, Xen and shadowed PV guests run
directly the respective shadow page tables.  For 64-bit PV guests this
means running on the shadow of the guest root page table.

In the course of dealing with shortage of memory in the shadow pool
associated with a domain, shadows of page tables may be torn down.  This
tearing down may include the shadow root page table that the CPU in
question is presently running on.  While a precaution exists to
supposedly prevent the tearing down of the underlying live page table,
the time window covered by that precaution isn't large enough.

CVSS Score: 7.8 (HIGH)
CWE: CWE-273, CWE-273
References: https://xenbits.xenproject.org/xsa/advisory-438.html; http://xenbits.xen.org/xsa/advisory-438.html; https://xenbits.xenproject.org/xsa/advisory-438.html
CVE: CVE-2023-34323
Published: 2024-01-05
Description: When a transaction is committed, C Xenstored will first check
the quota is correct before attempting to commit any nodes.  It would
be possible that accounting is temporarily negative if a node has
been removed outside of the transaction.

Unfortunately, some versions of C Xenstored are assuming that the
quota cannot be negative and are using assert() to confirm it.  This
will lead to C Xenstored crash when tools are built without -DNDEBUG
(this is the default).

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://xenbits.xenproject.org/xsa/advisory-440.html; http://xenbits.xen.org/xsa/advisory-440.html; https://xenbits.xenproject.org/xsa/advisory-440.html
CVE: CVE-2023-34324
Published: 2024-01-05
Description: Closing of an event channel in the Linux kernel can result in a deadlock.
This happens when the close is being performed in parallel to an unrelated
Xen console action and the handling of a Xen console interrupt in an
unprivileged guest.

The closing of an event channel is e.g. triggered by removal of a
paravirtual device on the other side. As this action will cause console
messages to be issued on the other side quite often, the chance of
triggering the deadlock is not neglectable.

Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel
on Arm doesn't use queued-RW-locks, which are required to trigger the
issue (on Arm32 a waiting writer doesn't block further readers to get
the lock).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html; https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html; https://xenbits.xenproject.org/xsa/advisory-441.html
CVE: CVE-2023-34325
Published: 2024-01-05
Description: 
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

libfsimage contains parsing code for several filesystems, most of them based on
grub-legacy code.  libfsimage is used by pygrub to inspect guest disks.

Pygrub runs as the same user as the toolstack (root in a priviledged domain).

At least one issue has been reported to the Xen Security Team that allows an
attacker to trigger a stack buffer overflow in libfsimage.  After further
analisys the Xen Security Team is no longer confident in the suitability of
libfsimage when run against guest controlled input with super user priviledges.

In order to not affect current deployments that rely on pygrub patches are
provided in the resolution section of the advisory that allow running pygrub in
deprivileged mode.

CVE-2023-4949 refers to the original issue in the upstream grub
project ("An attacker with local access to a system (either through a
disk or external drive) can present a modified XFS partition to
grub-legacy in such a way to exploit a memory corruption in grub’s XFS
file system implementation.")  CVE-2023-34325 refers specifically to
the vulnerabilities in Xen's copy of libfsimage, which is decended
from a very old version of grub.

CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://xenbits.xenproject.org/xsa/advisory-443.html; http://xenbits.xen.org/xsa/advisory-443.html; https://xenbits.xenproject.org/xsa/advisory-443.html
CVE: CVE-2023-34326
Published: 2024-01-05
Description: The caching invalidation guidelines from the AMD-Vi specification (48882—Rev
3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction
(see stale DMA mappings) if some fields of the DTE are updated but the IOMMU
TLB is not flushed.

Such stale DMA mappings can point to memory ranges not owned by the guest, thus
allowing access to unindented memory regions.

CVSS Score: 7.8 (HIGH)
CWE: CWE-672
References: https://xenbits.xenproject.org/xsa/advisory-442.html; http://xenbits.xen.org/xsa/advisory-442.html; https://xenbits.xenproject.org/xsa/advisory-442.html
CVE: CVE-2023-34327
Published: 2024-01-05
Description: 
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

AMD CPUs since ~2014 have extensions to normal x86 debugging functionality.
Xen supports guests using these extensions.

Unfortunately there are errors in Xen's handling of the guest state, leading
to denials of service.

 1) CVE-2023-34327 - An HVM vCPU can end up operating in the context of
    a previous vCPUs debug mask state.

 2) CVE-2023-34328 - A PV vCPU can place a breakpoint over the live GDT.
    This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock
    up the CPU entirely.

CVSS Score: 5.5 (MEDIUM)
References: https://xenbits.xenproject.org/xsa/advisory-444.html; http://xenbits.xen.org/xsa/advisory-444.html; https://xenbits.xenproject.org/xsa/advisory-444.html
CVE: CVE-2023-34328
Published: 2024-01-05
Description: 
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

AMD CPUs since ~2014 have extensions to normal x86 debugging functionality.
Xen supports guests using these extensions.

Unfortunately there are errors in Xen's handling of the guest state, leading
to denials of service.

 1) CVE-2023-34327 - An HVM vCPU can end up operating in the context of
    a previous vCPUs debug mask state.

 2) CVE-2023-34328 - A PV vCPU can place a breakpoint over the live GDT.
    This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock
    up the CPU entirely.

CVSS Score: 5.5 (MEDIUM)
References: https://xenbits.xenproject.org/xsa/advisory-444.html; http://xenbits.xen.org/xsa/advisory-444.html; https://xenbits.xenproject.org/xsa/advisory-444.html
CVE: CVE-2023-39294
Published: 2024-01-05
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-54; https://www.qnap.com/en/security-advisory/qsa-23-54
CVE: CVE-2023-39296
Published: 2024-01-05
Description: A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later

CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://www.qnap.com/en/security-advisory/qsa-23-64; https://www.qnap.com/en/security-advisory/qsa-23-64
CVE: CVE-2023-41287
Published: 2024-01-05
Description: A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.7.2 ( 2023/11/23 ) and later

CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-23-55; https://www.qnap.com/en/security-advisory/qsa-23-55
CVE: CVE-2023-41288
Published: 2024-01-05
Description: An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.7.2 ( 2023/11/23 ) and later

CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-55; https://www.qnap.com/en/security-advisory/qsa-23-55
CVE: CVE-2023-41289
Published: 2024-01-05
Description: An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following version:
QcalAgent 1.1.8 and later

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-34; https://www.qnap.com/en/security-advisory/qsa-23-34
CVE: CVE-2023-45039
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-45040
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-45041
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-45042
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-45043
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-45044
Published: 2024-01-05
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120
References: https://www.qnap.com/en/security-advisory/qsa-23-27; https://www.qnap.com/en/security-advisory/qsa-23-27
CVE: CVE-2023-46835
Published: 2024-01-05
Description: The current setup of the quarantine page tables assumes that the
quarantine domain (dom_io) has been initialized with an address width
of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.

However dom_io being a PV domain gets the AMD-Vi IOMMU page tables
levels based on the maximum (hot pluggable) RAM address, and hence on
systems with no RAM above the 512GB mark only 3 page-table levels are
configured in the IOMMU.

On systems without RAM above the 512GB boundary
amd_iommu_quarantine_init() will setup page tables for the scratch
page with 4 levels, while the IOMMU will be configured to use 3 levels
only, resulting in the last page table directory (PDE) effectively
becoming a page table entry (PTE), and hence a device in quarantine
mode gaining write access to the page destined to be a PDE.

Due to this page table level mismatch, the sink page the device gets
read/write access to is no longer cleared between device assignment,
possibly leading to data leaks.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://xenbits.xenproject.org/xsa/advisory-445.html; http://xenbits.xen.org/xsa/advisory-445.html; https://xenbits.xenproject.org/xsa/advisory-445.html
CVE: CVE-2023-46836
Published: 2024-01-05
Description: The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative
Return Stack Overflow) are not IRQ-safe.  It was believed that the
mitigations always operated in contexts with IRQs disabled.

However, the original XSA-254 fix for Meltdown (XPTI) deliberately left
interrupts enabled on two entry paths; one unconditionally, and one
conditionally on whether XPTI was active.

As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations
are not active together by default.  Therefore, there is a race
condition whereby a malicious PV guest can bypass BTC/SRSO protections
and launch a BTC/SRSO attack against Xen.

CVSS Score: 4.7 (MEDIUM)
References: https://xenbits.xenproject.org/xsa/advisory-446.html; http://xenbits.xen.org/xsa/advisory-446.html; https://xenbits.xenproject.org/xsa/advisory-446.html
CVE: CVE-2023-46837
Published: 2024-01-05
Description: Arm provides multiple helpers to clean & invalidate the cache
for a given region.  This is, for instance, used when allocating
guest memory to ensure any writes (such as the ones during scrubbing)
have reached memory before handing over the page to a guest.

Unfortunately, the arithmetics in the helpers can overflow and would
then result to skip the cache cleaning/invalidation.  Therefore there
is no guarantee when all the writes will reach the memory.

This undefined behavior was meant to be addressed by XSA-437, but the
approach was not sufficient.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-119
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JFVKWYQFRUU3CAS53THTUKXEOUDWI42G/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XLL6SQ6IKFYXLYWITYZCRV5IBRK5G35R/; https://xenbits.xenproject.org/xsa/advisory-447.html
CVE: CVE-2023-47219
Published: 2024-01-05
Description: A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
QuMagie 2.2.1 and later

CVSS Score: 3.5 (LOW)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-23-32; https://www.qnap.com/en/security-advisory/qsa-23-32
CVE: CVE-2023-47559
Published: 2024-01-05
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
QuMagie 2.2.1 and later

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-23-23; https://www.qnap.com/en/security-advisory/qsa-23-23