Shahnawaz Shaikh

**Name of the Vulnerable Software and Affected Versions** QuTScloud versions prior to 5.1.5.2651 QTS versions prior to 5.1.4.2596 build 20231128 QuTS hero versions prior to 5.1.4.2596 build 20231128 **Description** A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. **Recommendations** For QuTScloud versions prior to 5.1.5.2651, update to version 5.1.5.2651 or later. For QTS versions prior to 5.1.4.2596 build 20231128, update to version 5.1.4.2596 build 20231128 or later. For QuTS hero versions prior to 5.1.4.2596 build 20231128, update to version 5.1.4.2596 build 20231128 or later.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 4.5.4.2627 build 20231225 QuTScloud versions prior to c5.1.5.2651 **Description** The issue is related to an incorrect authorization procedure in QNAP operating system versions, which could allow authenticated users to bypass intended access restrictions via a network. **Recommendations** For QTS versions prior to 4.5.4.2627 build 20231225, update to QTS 4.5.4.2627 build 20231225 or later. For QuTScloud versions prior to c5.1.5.2651, update to QuTScloud c5.1.5.2651 or later.

**Name of the Vulnerable Software and Affected Versions** Cisco Enterprise Chat and Email (ECE) (affected versions not specified) **Description** A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to execute arbitrary code in the context of the interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.