Kaibro

Name of the Vulnerable Software and Affected Versions: SmartRobot from INTUMIT (affected versions not specified) Description: The issue is related to the improper validation of a specific page parameter, allowing unauthenticated remote attackers to inject JavaScript code for Reflected Cross-site Scripting attacks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

A SQL injection issue has been reported, potentially allowing authenticated users to inject malicious code via a network.

A cross-site scripting (XSS) issue has been reported, potentially allowing authenticated users to inject malicious code via a network.

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data.

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data.

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands.

The issue concerns the file uploading function in OMICARD EDM, which does not properly restrict the upload of files with dangerous types. This allows an unauthenticated remote attacker to upload and execute arbitrary files, potentially leading to the execution of system commands or disruption of service. The vulnerability can be exploited by a remote attacker to perform arbitrary actions.

The file uploading function in the affected devices does not properly restrict the upload of files with dangerous types. This allows an unauthenticated remote attacker to upload and run arbitrary executable files, potentially enabling them to perform arbitrary system commands or disrupt service.

The file upload function has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this to upload arbitrary files and execute arbitrary code, potentially manipulating the system or disrupting the service.

The issue is related to improper authentication in the Agentflow BPM enterprise management system. A remote attacker with general user privilege can exploit this by changing the name of the user account to acquire arbitrary account privilege. This allows the attacker to access, manipulate the system, or disrupt the service.

The Agentflow BPM file download function has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and download arbitrary system files.