Leeya_Bug

**Nome do Software Vulnerável e Versões Afetadas** QNAP QTS versões anteriores a 5.1.9.2954 build 20241120 QNAP QuTS hero h5.1.9 versões anteriores a 5.1.9.2954 build 20241120 **Descrição** Um problema de escrita fora dos limites foi relatado, potencialmente permitindo que atacantes remotos com acesso de administrador modifiquem ou corrompam a memória. **Recomendações** Para versões do QNAP QTS anteriores a 5.1.9.2954 build 20241120, atualize para o QTS 5.1.9.2954 build 20241120 ou posterior. Para versões do QNAP QuTS hero h5.1.9 anteriores a 5.1.9.2954 build 20241120, atualize para o QuTS hero h5.1.9.2954 build 20241120 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do PaddlePaddle anteriores à 2.6.0 **Descrição** O problema está relacionado a uma injeção de comando na função `get online pass interval`, permitindo a execução de comandos arbitrários no sistema operacional. **Recomendações** Para versões anteriores à 2.6.0, atualize para a versão 2.6.0 ou posterior para resolver o problema. Como solução temporária, considere desativar a função `get online pass interval` até que um patch esteja disponível.

**Nome do software vulnerável e versões afetadas** Versões do PaddlePaddle anteriores à 2.6.0 **Descrição** O problema consiste em uma injeção de comando na função `convert shape compare`, permitindo a execução de comandos arbitrários no sistema operacional. **Recomendações** Para versões anteriores à 2.6.0, atualize para a versão 2.6.0 ou posterior para resolver o problema. Como solução temporária, considere desativar a função `convert shape compare` até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** abupy versions up to v0.4.0 **Description** The issue is a SQL injection vulnerability via the component `abupy.MarketBu.ABuSymbol.search to symbol dict`. This vulnerability allows for potential exploitation. **Recommendations** For versions up to v0.4.0, update to a version later than v0.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the `search to symbol dict` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dango-Translator version 4.5.5 **Description** A remote command execution (RCE) issue was found in Dango-Translator via the `app/config/cloud config.json` component. **Recommendations** For Dango-Translator version 4.5.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fast-poster version 2.15.0 **Description** The issue concerns a Cross Site Scripting (XSS) problem. Specifically, it involves the upload of files, where the check for image files is performed based on binary data but does not strictly verify the file suffix. This weakness is exploited at the "/server/fast.py" endpoint, particularly through the `ApiUploadHandler.post` function, leading to stored XSS. The estimated number of potentially affected devices worldwide is not provided. **Recommendations** For fast-poster version 2.15.0, as a temporary workaround, consider disabling the file upload functionality at the `/server/fast.py` endpoint, specifically through the `ApiUploadHandler.post` function, until a patch is available. Restrict access to the `ApiUploadHandler.post` function to minimize the risk of exploitation. Avoid using the file upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebsiteGuide version 0.2 **Description** The issue allows for Remote Command Execution (RCE) via image upload. **Recommendations** For version 0.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** funadmin versions 3.3.2 through 3.3.3 **Description** The issue concerns insecure file upload via the plugins install. **Recommendations** For versions 3.3.2 and 3.3.3, consider disabling the plugins install feature until a patch is available. Restrict access to the plugins install module to minimize the risk of exploitation.