CVE-2025-35053 Newforma Info Exchange (NIX) arbitrary file read and delete

Newforma Info Exchange NIX accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabl...

CVE-2025-35053 Newforma Info Exchange (NIX) arbitrary file read and delete

Newforma Info Exchange NIX accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabl...

CVE-2025-35053

Summary of findings (CVE-2025-35053): Newforma Info Exchange (NIX) exposes a vulnerability in the endpoint "/UserWeb/Common/MarkupServices.ashx" where the command DownloadExportedPDF allows an authenticated user to read and delete arbitrary files with the NT AUTHORITY\NetworkService privileges. T...

CVE-2025-11166 WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having...

PT-2025-41469

Name of the Vulnerable Software and Affected Versions Newforma Info Exchange NIX versions prior to 2023.1 Description Newforma Info Exchange NIX allows authenticated users to read and delete arbitrary files with 'NT AUTHORITYNetworkService' privileges through requests to the...

PT-2025-41465

Name of the Vulnerable Software and Affected Versions D-Link Nuclias Connect versions prior to 1.3.1.4 Description The software contains a directory traversal issue in the /api/web/dnc/global/database/deleteBackup endpoint. This is due to insufficient input validation of the deleteBackupList...

SUSE CVE-2023-53649

In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel-priv area In 3cb4d5e00e037c70 "perf trace: Free syscall tp fields in evsel-priv" it only was freeing if strcmpevsel-tpformat-system, "syscalls" returned zero, while the corresponding initializati...

CVE-2025-42706

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility LTV...

CVE-2025-42701 CrowdStrike Falcon Sensor for Windows Race Condition

A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility...

CVE-2025-42706 CrowdStrike Falcon Sensor for Windows Logic Error

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility LTV...

What to do when you click on a suspicious link

October is Cybersecurity Awareness Month, and as the tech-savvy friend or family member, people probably come to you for advice. One of the most common questions is: "I clicked a suspicious link. What do I do now?" Don't worry -- panic won't help, but a calm, step-by-step response will. Share thi...

PT-2025-41295

Name of the Vulnerable Software and Affected Versions Falcon sensor for Windows versions prior to 7.24 Description A logic error in the Falcon sensor for Windows could allow an attacker, with existing code execution capabilities on a host, to delete arbitrary files. There is no indication of...

PT-2025-41294

Name of the Vulnerable Software and Affected Versions CrowdStrike Falcon sensor for Windows versions prior to 7.24 CrowdStrike Falcon sensor for Windows Long Term Visibility LTV sensors prior to 7.24 Description A race condition exists in the Falcon sensor for Windows that could allow an attacker...

CVE-2025-11343

A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly an...

CVE-2023-53649

In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel-priv area In 3cb4d5e00e037c70 "perf trace: Free syscall tp fields in evsel-priv" it only was freeing if strcmpevsel-tpformat-system, "syscalls" returned zero, while the corresponding initializati...

UBUNTU-CVE-2022-50538

In the Linux kernel, the following vulnerability has been resolved: vme: Fix error not catched in fakeinit In fakeinit, rootdeviceregister is possible to fail but it's ignored, which can cause unregistering vmeroot fail when exit. general protection fault, probably for non-canonical address...

CVE-2025-11400

SourceCodester Hotel and Lodge Management System 1.0 contains a SQL injection vulnerability in the /del_room.php endpoint triggered by manipulating the ID parameter. The CVE-2025-11400 entries indicate remote exploitation with publicly available exploits. The issue is documented with multiple ven...

CVE-2025-11400 SourceCodester Hotel and Lodge Management System del_room.php sql injection

A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /delroom.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2023-53673

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: call disconnect callback before deleting conn In hcicsdisconnect, we do hciconndel even if disconnection failed. ISO, L2CAP and SCO connections refer to the hciconn without hciconnget, so disconncfm must be...

CVE-2023-53673 Bluetooth: hci_event: call disconnect callback before deleting conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: call disconnect callback before deleting conn In hcicsdisconnect, we do hciconndel even if disconnection failed. ISO, L2CAP and SCO connections refer to the hciconn without hciconnget, so disconncfm must be...