deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39960
Published: 2023-10-13
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server starting with 25.0.0 and prior to 25.09 and 26.04; as well as Nextcloud Enterprise Server starting with 22.0.0 and prior to 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4; missing protection allows an attacker to brute force passwords on the WebDAV API. Nextcloud Server 25.0.9 and 26.0.4 and Nextcloud Enterprise Server 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, and 26.0.4 contain patches for this issue. No known workarounds are available.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2hrc-5fgp-c9c9; https://github.com/nextcloud/server/pull/38046; https://hackerone.com/reports/1924212
CVE: CVE-2023-45107
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in GoodBarber plugin <= 1.0.22 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/goodbarber/wordpress-goodbarber-plugin-1-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/goodbarber/wordpress-goodbarber-plugin-1-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45108
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mailrelay plugin <= 2.1.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mailrelay/wordpress-mailrelay-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mailrelay/wordpress-mailrelay-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45130
Published: 2023-10-13
Description: Frontier is Substrate's Ethereum compatibility layer. Prior to commit aea528198b3b226e0d20cce878551fd4c0e3d5d0, at the end of a contract execution, when opcode SUICIDE marks a contract to be deleted, the software uses `storage::remove_prefix` (now renamed to `storage::clear_prefix`) to remove all storages associated with it. This is a single IO primitive call passing the WebAssembly boundary. For large contracts, the call (without providing a `limit` parameter) can be slow. In addition, for parachains, all storages to be deleted will be part of the PoV, which easily exceed relay chain PoV size limit. On the other hand, Frontier's maintainers only charge a fixed cost for opcode SUICIDE. The maintainers consider the severity of this issue high, because an attacker can craft a contract with a lot of storage values on a parachain, and then call opcode SUICIDE on the contract. If the transaction makes into a parachain block, the parachain will then stall because the PoV size will exceed relay chain's limit. This is especially an issue for XCM transactions, because they can't be skipped. Commit aea528198b3b226e0d20cce878551fd4c0e3d5d0 contains a patch for this issue. For parachains, it's recommended to issue an emergency runtime upgrade as soon as possible. For standalone chains, the impact is less severe because the issue mainly affects PoV sizes. It's recommended to issue a normal runtime upgrade as soon as possible. There are no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/paritytech/frontier/commit/aea528198b3b226e0d20cce878551fd4c0e3d5d0; https://github.com/paritytech/frontier/pull/1212; https://github.com/paritytech/frontier/security/advisories/GHSA-gc88-2gvv-gp3v
CVE: CVE-2023-45162
Published: 2023-10-13
Description: Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. 

Application of the relevant hotfix remediates this issue.

for v8.1.2 apply hotfix Q23166
for v8.4.1 apply hotfix Q23164
for v9.0.1 apply hotfix Q23169

SaaS implementations on v23.7.1 will automatically have hotfix Q23173 applied. Customers with SaaS versions below this are urged to upgrade urgently - please contact 1E to arrange this
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2004/; https://www.1e.com/trust-security-compliance/cve-info/
CVE: CVE-2023-45463
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20hostname%20parameter%20leads%20to%20DOS.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20hostname%20parameter%20leads%20to%20DOS.md
CVE: CVE-2023-45464
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20servDomain%20parameter%20leads%20to%20DOS.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20servDomain%20parameter%20leads%20to%20DOS.md
CVE: CVE-2023-45465
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ddnsDomainName%20parameter%20in%20Dynamic%20DNS%20setting.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ddnsDomainName%20parameter%20in%20Dynamic%20DNS%20setting.md
CVE: CVE-2023-45466
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20pin_host%20parameter%20in%20wps%20setting.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20pin_host%20parameter%20in%20wps%20setting.md
CVE: CVE-2023-45467
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ntpServIP%20parameter%20in%20Time%20Settings%20.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ntpServIP%20parameter%20in%20Time%20Settings%20.md
CVE: CVE-2023-45468
Published: 2023-10-13
Description: Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20pingWdogIp%20parameter%20leads%20to%20DOS.md; https://github.com/adhikara13/CVE/blob/main/netis_N3/buffer%20overflow%20in%20pingWdogIp%20parameter%20leads%20to%20DOS.md
CVE: CVE-2023-4517
Published: 2023-10-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/hestiacp/hestiacp/commit/d30e3edbca[PII_REDACTED]e46ab222cb7aed9b319a; https://huntr.dev/bounties/508d1d21-c45d-47ff-833f-50c671882e51; https://github.com/hestiacp/hestiacp/commit/d30e3edbca[PII_REDACTED]e46ab222cb7aed9b319a
CVE: CVE-2023-4829
Published: 2023-10-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/froxlor/froxlor/commit/4711a414360782fe4fc94f7c25027077cbcdf73d; https://huntr.dev/bounties/babd73ca-6c80-4145-8c7d-33a883fe606b; https://github.com/froxlor/froxlor/commit/4711a414360782fe4fc94f7c25027077cbcdf73d
CVE: CVE-2023-4995
Published: 2023-10-13
Description: The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/embed-calendly-scheduling/tags/3.6/includes/embed.php#L140; https://www.wordfence.com/threat-intel/vulnerabilities/id/d1bf83df-7a1f-4572-9c8d-1013750d51d7?source=cve; https://plugins.trac.wordpress.org/browser/embed-calendly-scheduling/tags/3.6/includes/embed.php#L140
CVE: CVE-2023-5240
Published: 2023-10-13
Description: Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request.



CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2023-0017; https://devolutions.net/security/advisories/DEVO-2023-0017
CVE: CVE-2023-45109
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in ZAKSTAN WhitePage plugin <= 1.1.5 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/white-page-publication/wordpress-whitepage-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/white-page-publication/wordpress-whitepage-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45391
Published: 2023-10-13
Description: A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://the-it-wonders.blogspot.com/2023/10/granding-utime-master-stored-xss.html; https://the-it-wonders.blogspot.com/2023/10/granding-utime-master-stored-xss.html
CVE: CVE-2023-45393
Published: 2023-10-13
Description: An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://the-it-wonders.blogspot.com/2023/10/granding-utime-master-idor.html; https://the-it-wonders.blogspot.com/2023/10/granding-utime-master-idor.html
CVE: CVE-2023-33303
Published: 2023-10-13
Description: A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands via api request
CVSS Score: 8.1 (HIGH)
CWE: CWE-613, CWE-613
References: https://fortiguard.com/psirt/FG-IR-23-007; https://fortiguard.com/psirt/FG-IR-23-007
CVE: CVE-2023-41680
Published: 2023-10-13
Description: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-311; https://fortiguard.com/psirt/FG-IR-23-311
CVE: CVE-2023-41681
Published: 2023-10-13
Description: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-311; https://fortiguard.com/psirt/FG-IR-23-311
CVE: CVE-2023-41682
Published: 2023-10-13
Description: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4 all versions allows attacker to denial of service via crafted http requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://fortiguard.com/psirt/FG-IR-23-280; https://fortiguard.com/psirt/FG-IR-23-280
CVE: CVE-2023-41836
Published: 2023-10-13
Description: An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-215; https://fortiguard.com/psirt/FG-IR-23-215
CVE: CVE-2023-41843
Published: 2023-10-13
Description: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions, FortiSandbox 2.5 all versions, FortiSandbox 2.4.1 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-23-273; https://fortiguard.com/psirt/FG-IR-23-273
CVE: CVE-2023-45267
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Zizou1988 IRivYou plugin <= 2.2.1 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wooreviews-importer/wordpress-irivyou-add-reviews-from-aliexpress-and-amazon-to-woocommerce-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wooreviews-importer/wordpress-irivyou-add-reviews-from-aliexpress-and-amazon-to-woocommerce-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45268
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/hitsteps-visitor-manager/wordpress-hitsteps-web-analytics-plugin-5-85-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/hitsteps-visitor-manager/wordpress-hitsteps-web-analytics-plugin-5-85-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-40682
Published: 2023-10-13
Description: IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs.  IBM X-Force ID:  263833.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/263833; https://www.ibm.com/support/pages/node/7051204; https://exchange.xforce.ibmcloud.com/vulnerabilities/263833
CVE: CVE-2023-45269
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 2.0.25 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45270
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-45276
Published: 2023-10-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in automatededitor.Com Automated Editor plugin <= 1.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/automated-editor/wordpress-automated-editor-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/automated-editor/wordpress-automated-editor-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-4499
Published: 2023-10-13
Description: A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]618-16; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]618-16
CVE: CVE-2023-5409
Published: 2023-10-13
Description: HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]233-16; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]233-16
CVE: CVE-2023-5449
Published: 2023-10-13
Description: A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a monitor’s Theft Deterrence to be deactivated.
CVSS Score: 3.3 (LOW)
References: https://support.hp.com/us-en/document/ish_9[PII_REDACTED]794-16; https://support.hp.com/us-en/document/ish_9[PII_REDACTED]794-16
CVE: CVE-2023-32970
Published: 2023-10-13
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h5.1.0.2453 build 20230708 and later
QuTS hero h4.5.4.2476 build 20230728 and later
QuTScloud c5.1.0.2498 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later

CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-23-41; https://www.qnap.com/en/security-advisory/qsa-23-41
CVE: CVE-2023-32973
Published: 2023-10-13
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h4.5.4.2476 build 20230728 and later
QuTScloud c5.1.0.2498 and later

CVSS Score: 3.8 (LOW)
CWE: CWE-120, CWE-121, CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-23-41; https://www.qnap.com/en/security-advisory/qsa-23-41
CVE: CVE-2023-32974
Published: 2023-10-13
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.0.2444 build 20230629 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTScloud c5.1.0.2498 and later

CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-23-42; https://www.qnap.com/en/security-advisory/qsa-23-42
CVE: CVE-2023-32976
Published: 2023-10-13
Description: An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following version:
Container Station 2.6.7.44 and later

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-23-44; https://www.qnap.com/en/security-advisory/qsa-23-44
CVE: CVE-2023-34975
Published: 2023-10-13
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
QuTScloud is not affected.

We have already fixed the vulnerability in the following versions:
QuTS hero h4.5.4.2626 build 20231225 and later
QTS 4.5.4.2627 build 20231225 and later
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78, CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-24-12; https://www.qnap.com/en/security-advisory/qsa-24-12
CVE: CVE-2023-34976
Published: 2023-10-13
Description: A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.7.0 ( 2023/07/27 ) and later
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-23-52; https://www.qnap.com/en/security-advisory/qsa-23-52
CVE: CVE-2023-34977
Published: 2023-10-13
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.7.0 ( 2023/07/27 ) and later

CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-23-52; https://www.qnap.com/en/security-advisory/qsa-23-52
CVE: CVE-2023-36559
Published: 2023-10-13
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.2 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36559; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36559; https://security.gentoo.org/glsa/202402-05
CVE: CVE-2023-4263
Published: 2023-10-13
Description: Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver
CVSS Score: 7.6 (HIGH)
CWE: CWE-120, CWE-121, CWE-120
References: http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html; http://seclists.org/fulldisclosure/2023/Nov/1; http://www.openwall.com/lists/oss-security/2023/11/07/1