CVE-2024-41247

An Incorrect Access Control vulnerability was found in /smsa/addclass.php and /smsa/addclasssubmit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new class entry...

PT-2024-29322 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An Incorrect Access Control issue was found in the /smsa/view class.php endpoint, allowing remote unauthenticated attackers to view class details. This could lead to...

CVE-2024-41244

An Incorrect Access Control vulnerability exists in the Kashipara Responsive School Management System v3.2.0 . The flaw is located in the /smsa/view_class.php endpoint, which allows remote unauthenticated attackers to view sensitive CLASS details . This could lead to unauthorized access to privat...

CVE-2024-7500

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function savesettings of the file admin/adminclass.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. Th...

PT-2024-38390 · Itsourcecode · Itsourcecode Airline Reservation System

Name of the Vulnerable Software and Affected Versions: itsourcecode Airline Reservation System version 1.0 Description: A critical issue has been found in the itsourcecode Airline Reservation System, where the save settings function in the admin/admin class.php file is affected. The manipulation ...

jflex:JflexFuzzer: Security exception in jflex.core.NFA.insertNFA

Detailed Report: https://oss-fuzz.com/testcase?key=5488751948660736 Project: jflex Fuzzing Engine: libFuzzer Fuzz Target: JflexFuzzer Job Type: libfuzzerasanjflex Platform Id: linux Crash Type: Security exception Crash Address: Crash State: jflex.core.NFA.insertNFA...

classmgmt.com Cross Site Scripting vulnerability OBB-3953589

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

javaparser:parseFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6197193074081792 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

CVE-2024-7389: Insufficiently Protected Credentials

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make...

The vulnerability in the upload.php script of the UploadFile class in the Ruijie EG-2000SE software library allows attackers to upload arbitrary files.

The vulnerability of the upload.php script in the UploadFile class of the Ruijie EG-2000SE gateway software relates to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability allows an attacker to remotely upload any type of files...

CVE-2024-42129

In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devmmutexinit for mutex initialization In this driver LEDs are registered using devmledclassdevregister so they are automatically unregistered after module's remove is done. ledclassdevunregister calls module's...

The vulnerability of the Telerik Report Server software’s reporting control tool lies in its reliance on external controls for selecting classes. This allows an attacker to execute arbitrary code.

The vulnerability of the Telerik Report Server reporting management software lies in the use of external control for selecting classes when input data is provided. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-4410

CVE-2024-4410 — IgnitionDeck Crowdfunding Platform (WordPress) Affected: IgnitionDeck Crowdfunding Platform plugin for WordPress (

CVE-2024-4410: Missing Authorization

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. This makes it possible for...

PT-2024-30951 · WordPress · Ignitiondeck Crowdfunding Platform

Name of the Vulnerable Software and Affected Versions: IgnitionDeck Crowdfunding Platform plugin for WordPress versions up to, and including, 1.9.8 Description: The issue is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. Th...

SUSE-SU-2024:2571-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-39371: iouring: check for non-NULL file pointer in iofilecanpoll bsc1226990. - CVE-2023-52846: hsr: Prevent use after free in prpcreatetaggedframe bsc122509...

GHSA-W36W-948J-XHFW H2O vulnerable to Deserialization of Untrusted Data

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

PT-2024-40821 · Jflex · Jflex

Name of the Vulnerable Software and Affected Versions: jflex affected versions not specified Description: A security exception crash has been reported. The crash occurs in the jflex.core.NFA.insertNFA function, which is called by java.base/java.lang.ClassLoader.defineClass1 and...

Triangle MicroWorks SCADA Data Gateway Information Disclosure Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product developed by Triangle MicroWorks, Inc. and is mainly used for data acquisition and monitoring in industrial automation control systems. Triangle MicroWorks SCADA Data Gateway suffers from an information disclosure vulnerabilit...

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager (ARM) access control software allows a perpetrator to execute arbitrary commands.

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager ARM access control software is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...