Yingmuo

An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

A logic issue involving state management allows an application to bypass Gatekeeper checks. Gatekeeper is a security feature that ensures only trusted software runs on the system.

An out-of-bounds write issue occurs when processing a maliciously crafted 3D model, which may lead to memory corruption. This is caused by insufficient bounds checking during the processing of the model data.

A command injection vulnerability exists in QuNetSwitch. A local attacker gaining administrator privileges can exploit this issue to execute arbitrary commands.

A command injection issue exists in QuNetSwitch. Remote attackers can potentially execute arbitrary commands.

A use of hard-coded credentials allows remote attackers to gain unauthorized access.

A command injection issue exists in QuNetSwitch. Successful exploitation allows a remote attacker who has obtained a user account to execute arbitrary commands.

Name of the Vulnerable Software and Affected Versions: QNAP SMB Service versions prior to 4.15.002 QNAP SMB Service h versions prior to h4.15.002 Description: A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. The vulnerability is related to the lack of protection of the SQL query structure. It has been exploited in recent hacking contests, showcasing high-risk attack vectors, and may allow unauthorized access to QNAP NAS devices and sensitive data. Recommendations: For QNAP SMB Service versions prior to 4.15.002, update to version 4.15.002 or later. For QNAP SMB Service h versions prior to h4.15.002, update to version h4.15.002 or later. As a temporary workaround, consider restricting access to the SMB Service until a patch is applied.

A difficult to exploit vulnerability in Oracle VM VirtualBox allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. The vulnerability is related to errors in authorization due to a buffer overflow in memory. Successful attacks can result in takeover of Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products.

An OS command injection issue has been reported, affecting the Media Streaming add-on. This could allow authenticated administrators to execute commands via a network. The issue is remotely exploitable.

An exposure of sensitive information issue has been reported, potentially allowing users to compromise the security of the system via a network.

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. The specific flaw exists within the handling of DHCP options, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Authentication is not required to exploit this issue.