Aymen Borgi

**Name of the Vulnerable Software and Affected Versions** QuLog Center versions prior to 1.7.0.829 QuLog Center versions prior to 1.8.0.888 QTS versions prior to 4.5.4.2957 build 20241119 QuTS hero versions prior to 4.5.4.2956 build 20241119 **Description** A server-side request forgery (SSRF) issue has been identified, which could allow remote attackers with administrator access to read application data. **Recommendations** For QuLog Center versions prior to 1.7.0.829, update to version 1.7.0.829 or later. For QuLog Center versions prior to 1.8.0.888, update to version 1.8.0.888 or later. For QTS versions prior to 4.5.4.2957 build 20241119, update to version 4.5.4.2957 build 20241119 or later. For QuTS hero versions prior to 4.5.4.2956 build 20241119, update to version 4.5.4.2956 build 20241119 or later.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 5.0.1.2514 build 20230906 QNAP QTS versions prior to 5.1.1.2491 build 20230815 QNAP QuTS hero h versions prior to h5.0.1.2515 build 20230907 QNAP QuTS hero h versions prior to h5.1.1.2488 build 20230812 QNAP QuTScloud c versions prior to c5.1.0.2498 **Description** A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. **Recommendations** For QNAP QTS versions prior to 5.0.1.2514 build 20230906, update to QTS 5.0.1.2514 build 20230906 or later. For QNAP QTS versions prior to 5.1.1.2491 build 20230815, update to QTS 5.1.1.2491 build 20230815 or later. For QNAP QuTS hero h versions prior to h5.0.1.2515 build 20230907, update to QuTS hero h5.0.1.2515 build 20230907 or later. For QNAP QuTS hero h versions prior to h5.1.1.2488 build 20230812, update to QuTS hero h5.1.1.2488 build 20230812 or later. For QNAP QuTScloud c versions prior to c5.1.0.2498, update to QuTScloud c5.1.0.2498 or later.

**Name of the Vulnerable Software and Affected Versions** ZoneMinder versions prior to 1.36.33 ZoneMinder versions prior to 1.37.33 **Description** The issue is an OS Command Injection via the `daemonControl()` function in the `/web/api/app/Controller/HostController.php` file. Any authenticated user can construct an API command to execute any shell command as the web user. **Recommendations** For versions prior to 1.36.33, update to version 1.36.33 or later. For versions prior to 1.37.33, update to version 1.37.33 or later. As a temporary workaround, consider restricting access to the `daemonControl()` function in the `/web/api/app/Controller/HostController.php` file until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Web Stories plugin for WordPress versions up to, and including 1.24.0 **Description** The issue arises from insufficient validation of URLs supplied via the `url` parameter in the "/v1/hotlink/proxy" REST API Endpoint. This allows authenticated users to make web requests to arbitrary locations, potentially querying and modifying information from internal services. **Recommendations** For versions up to, and including 1.24.0, update to a version later than 1.24.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/v1/hotlink/proxy" REST API Endpoint to minimize the risk of exploitation. Avoid using the `url` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** IBM QRadar SIEM versions 7.3.0 through 7.3.3 Patch 5 IBM QRadar SIEM versions 7.4.0 through 7.4.1 Patch 1 IBM QRadar SIEM versions 7.4.2 GA through 7.4.2 Patch 1 **Description** The issue allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This is due to a server side request forgery (SSRF) vulnerability. **Recommendations** For IBM QRadar SIEM versions 7.3.0 through 7.3.3 Patch 5, update to a version later than 7.3.3 Patch 5. For IBM QRadar SIEM versions 7.4.0 through 7.4.1 Patch 1, update to a version later than 7.4.1 Patch 1. For IBM QRadar SIEM versions 7.4.2 GA through 7.4.2 Patch 1, update to a version later than 7.4.2 Patch 1.