Zi0Black

تسمح هذه الثغرة لمستخدم ما بتعديل جميع تفاصيل مساحة الاسم، بما في ذلك الاسم والوصف والموقع الإلكتروني ورابط الدعم وروابط وسائل التواصل الاجتماعي، حتى لو لم يكن المستخدم مالكًا أو مساهمًا في مساحة الاسم. ويمكن القيام بذلك من خلال نقطة نهاية واجهة برمجة التطبيقات (API) `/user/namespace/{namespace}/details`، كما تؤثر هذه الثغرة أيضًا على نقطة النهاية `/user/namespace/{namespace}/details/logo`، مما يسمح للمستخدم بتغيير الشعار.

The issue is related to insufficient policy enforcement in developer tools, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could enable the attacker to bypass existing security restrictions and disclose protected information using a specially crafted website.

Name of the Vulnerable Software and Affected Versions: QNAP NAS running Q’center versions prior to Q’center v1.10.1004 QNAP NAS running Q’center versions prior to Q’center v1.12.1012 Description: A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. Recommendations: For QTS 4.5.3, update to Q’center v1.12.1012 or later. For QTS 4.3.6, update to Q’center v1.10.1004 or later. For QTS 4.3.3, update to Q’center v1.10.1004 or later. For QuTS hero h4.5.2, update to Q’center v1.12.1012 or later. For QuTScloud c4.5.4, update to Q’center v1.12.1012 or later.

Name of the Vulnerable Software and Affected Versions: Cisco node-jose versions prior to 0.11.0 Description: A security issue exists due to the node-jose library following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs), which allows a JSON Web Key (JWK) representing a public key to be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects, removing the original signature, adding a new public key to the header, and then signing the object using the associated private key. Recommendations: For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of JSON Web Tokens (JWTs) that contain embedded public keys until a patch is applied. Avoid trusting public keys embedded in JWS headers to minimize the risk of exploitation.