Alan Li

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider restricting the use of subdocuments to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Video Station versions prior to 5.8.2 **Description** An OS command injection issue has been reported, allowing authenticated users to execute commands via a network. **Recommendations** For versions prior to 5.8.2, update to Video Station 5.8.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** QuFirewall versions prior to 2.4.1 **Description** A path traversal issue has been reported, allowing authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. **Recommendations** For versions prior to 2.4.1, update to QuFirewall 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QuFirewall versions prior to 2.4.1 **Description** A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. **Recommendations** For versions prior to 2.4.1, update to QuFirewall 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Photo Station versions prior to 6.4.2 **Description** A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. The issue is related to the lack of protection measures for the web page structure, which could allow a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 6.4.2, update to Photo Station 6.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Photo Station application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Photo Station versions prior to 6.4.2 **Description** An OS command injection issue has been reported, potentially allowing authenticated users to execute commands via a network. The vulnerability is related to insufficient protection of the web page structure, which could enable a remote attacker to execute arbitrary commands. **Recommendations** For versions prior to 6.4.2, update to Photo Station 6.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Photo Station application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** QuMagie versions prior to 2.2.1 **Description** A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. **Recommendations** For versions prior to 2.2.1, update to QuMagie 2.2.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** QuMagie versions prior to 2.2.1 **Description** The issue is related to an OS command injection vulnerability. It could allow an authenticated user to execute commands via a network. This vulnerability exists due to the lack of measures to neutralize special elements. **Recommendations** For versions prior to 2.2.1, update to QuMagie 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting network access to the QuMagie application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** QcalAgent versions prior to 1.1.8 **Description** An OS command injection issue has been reported, potentially allowing authenticated users to execute commands via a network. **Recommendations** For versions prior to 1.1.8, update to QcalAgent version 1.1.8 or later to resolve the issue.