Alan Li

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider restricting the use of subdocuments to minimize the risk of exploitation.

An OS command injection issue has been reported, allowing authenticated users to execute commands via a network.

A path traversal issue has been reported, allowing authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. The issue is related to the lack of protection measures for the web page structure, which could allow a remote attacker to execute arbitrary code.

An OS command injection issue has been reported, potentially allowing authenticated users to execute commands via a network. The vulnerability is related to insufficient protection of the web page structure, which could enable a remote attacker to execute arbitrary commands.

A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

The issue is related to an OS command injection vulnerability. It could allow an authenticated user to execute commands via a network. This vulnerability exists due to the lack of measures to neutralize special elements.

An OS command injection issue has been reported, potentially allowing authenticated users to execute commands via a network.