rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-19888 
An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the HCB_ESC case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T00:00:00.000Z
CVE-2018-19889 
An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 6 case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T00:00:00.000Z
CVE-2018-19890 
An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 2 case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T00:00:00.000Z
CVE-2018-19891 
An invalid memory address dereference was discovered in the huffcode function (libfaac/huff2.c) in Freeware Advanced Audio Coder (FAAC) 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the book 10 case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T00:00:00.000Z
CVE-2018-19892 
DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T03:00:00.000Z
CVE-2018-19893 
SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T03:00:00.000Z
CVE-2018-19894 
ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T04:00:00.000Z
CVE-2018-19895 
ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T04:00:00.000Z
CVE-2018-19896 
ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via the ids[] parameter in a slide action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T04:00:00.000Z
CVE-2018-19897 
ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T04:00:00.000Z
CVE-2018-19898 
ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T04:00:00.000Z
CVE-2018-19901 
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19902 
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19903 
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19904 
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19905 
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19906 
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19907 
A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T07:00:00.000Z
CVE-2018-19908 
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T16:00:00.000Z
CVE-2018-19911 
FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T18:00:00.000Z
CVE-2018-19913 
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T19:00:00.000Z
CVE-2018-19914 
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T19:00:00.000Z
CVE-2018-19915 
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T19:00:00.000Z
CVE-2018-19917 
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:21:00.000Z
CVE-2018-19918 
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T15:00:00.000Z
CVE-2018-19919 
Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T21:00:00.000Z
CVE-2018-19921 
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T22:00:00.000Z
CVE-2018-19922 
Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T22:00:00.000Z
CVE-2018-19923 
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-19924 
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-19925 
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. It has SQL injection via the member/member_order.php type parameter, related to the O_state parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-19926 
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-19927 
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-06T23:00:00.000Z
CVE-2018-19931 
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T07:00:00.000Z
CVE-2018-19932 
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T07:00:00.000Z
CVE-2018-19933 
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-19934 
SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T19:35:49.000Z
CVE-2018-19935 
ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T09:00:00.000Z
CVE-2018-19936 
PrinterOn Enterprise 4.1.4 allows Arbitrary File Deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-17T18:00:00.000Z
CVE-2018-19937 
A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by opening a URL and turning the phone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-31T16:00:00.000Z
CVE-2018-19939 
The Goodix GT9xx touchscreen driver for custom Linux kernels on Xiaomi daisy-o-oss and daisy-p-oss as used in Mi A2 Lite and RedMi6 pro devices through 2018-08-27 has a NULL pointer dereference in kfree after a kmalloc failure in gtp_read_Color in drivers/input/touchscreen/gt917d/gt9xx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-07T09:00:00.000Z
CVE-2018-19941 Cleartext Storage of Sensitive Information in Cookies
A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext inside cookies via certain widely-available tools. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.2.1379 build 20200730 (and later)
Problem types: cwe_id: CWE-315
description: CWE-315 Cleartext Storage of Sensitive Information in a Cookie
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QuTScloud
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-12-31T16:33:27.622Z
CVE-2018-19942 Cross-site Scripting Vulnerability in File Station
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QuTS hero
vendor: QNAP Systems Inc.
product: QuTScloud
Credits: lang: en
value: Independent Security Evaluators
Published: 2021-04-16T01:10:14.083Z
CVE-2018-19943 
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-10-28T17:55:18.000Z
CVE-2018-19944 Cleartext Transmission of Sensitive Information in SNMP
A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed this vulnerability in the following versions: QTS 4.4.3.1354 build 20200702 (and later)
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: QNAP Systems Inc.
product: QTS
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-12-31T16:33:27.820Z
CVE-2018-19945 Improper Limitation of a Pathname to a Restricted Directory in QTS
A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-12-31T16:33:27.917Z
CVE-2018-19946 
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
cwe_id: CWE-297
description: CWE-297 Improper Validation of Certificate with Host Mismatch
Affected products: vendor: QNAP Systems Inc.
product: Helpdesk
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-09-11T14:14:45.000Z
CVE-2018-19947 
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
cwe_id: CWE-209
description: CWE-209 Information Exposure Through an Error Message
cwe_id: CWE-210
description: CWE-210 Information Exposure Through Self-generated Error Message
Affected products: vendor: QNAP Systems Inc.
product: Helpdesk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-09-11T14:14:21.000Z
CVE-2018-19948 
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: QNAP Systems Inc.
product: Helpdesk
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-09-11T14:12:56.000Z
CVE-2018-19949 
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-10-28T17:55:18.000Z
CVE-2018-19950 
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: QNAP Systems Inc.
product: Music Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.523Z
CVE-2018-19951 
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: Music Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.569Z
CVE-2018-19952 
If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
cwe_id: CWE-943
description: CWE-943 Improper Neutralization of Special Elements in Data Query Logic
Affected products: vendor: QNAP Systems Inc.
product: Music Station
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-11-02T15:57:02.626Z
CVE-2018-19953 
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
vendor: QNAP Systems Inc.
product: QTS
Credits: lang: en
value: Independent Security Evaluators
Published: 2020-10-28T17:55:18.000Z