CVE-2024-56722 RDMA/hns: Fix cpu stuck caused by printings during reset

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix cpu stuck caused by printings during reset During reset, cmd to destroy resources such as qp, cq, and mr may fail, and error logs will be printed. When a large number of resources are destroyed, there will be lots o...

The vulnerability of the Fortinet FortiClient Enterprise Management Server (EMS) server lies in the incorrect path limitation for the restricted access directory. This allows a malicious actor to perform service denial-of-service attacks, read from or write to a limited number of files.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to perform maintenance actions, read from or write to a limited number of...

Information leakage vulnerability in the DiLink system of BYD Company Limited (CNVD-2025-01077)

BYD Co., Ltd. is a comprehensive enterprise covering the fields of electronics, automobile, new energy and rail transportation. An information leakage vulnerability exists in the DiLink system of BYD Company Limited, which can be exploited by attackers to obtain sensitive information...

CVE-2024-11952

CVE-2024-11952 covers a Limited Local PHP File Inclusion in Classic Addons for WPBakery Page Builder (WordPress) up to v3.0, exploitable via the style parameter by an authenticated user with Contributor-level access (or higher) with permissions granted by an Administrator. The issue allows includ...

CVE-2023-52943

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors...

CVE-2023-52944

Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors...

CVE-2023-52943

The CVE-2023-52943 vulnerability affects Synology Surveillance Station, specifically the Alert.Setting webapi component. Affected versions are prior to 9.2.0-11289 and 9.2.0-9289. The issue is described as an incorrect authorization vulnerability that allows remote authenticated users to perform ...

CVE-2023-52943

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors...

The vulnerability of the Citrix NetScaler Application Delivery Controller (previously Citrix ADC) and the Citrix NetScaler Gateway (previously Citrix Gateway) access control systems, related to behavior anomaly detection, allows attackers to gain unauthorized access to limited functions.

The vulnerability of the Citrix NetScaler Application Delivery Controller previously Citrix ADC and the Citrix NetScaler Gateway previously Citrix Gateway access control system is related to the violation of expected behavior. Exploiting this vulnerability can allow an attacker, operating remotel...

The vulnerability of microprogrammed software in industrial routers of the SCALANCE M-800 family (including S615, MUM-800, and RM1224) arises from incorrect restrictions on path names in the limited-access catalog, allowing attackers to influence the integrity of the system.

The vulnerability of microprogrammed software in industrial routers of the SCALANCE M-800 family including S615, MUM-800, and RM1224 is related to incorrect restrictions on path names in the limited-access catalog. Exploiting this vulnerability can allow a malicious actor to influence the integri...

WordPress Sky Addons for Elementor plugin <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update vulnerability

Cross-Site Request Forgery to Limited Arbitrary Options Update vulnerability discovered by vgo0 in WordPress Plugin Sky Addons for Elementor versions = 2.6.1...

CVE-2024-48899

A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...

CVE-2024-10126

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7 allows an authenticated user to read server local files of a limited set of filetypes via document preview...

CVE-2024-44308

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that th...

CVE-2024-11194

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtclimportsettings' function in all versions up to, and including, 3.1.15.1. This...

CVE-2024-41968

A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS...

CVE-2024-41968

CVE-2024-41968 affects WAGO devices (e.g., CC100 0751-9x01; Edge Controller 0752-8303/8000-0002; PFC100/PFC200 series; TP600 variants) where a low-privilege, remote attacker can modify the device’s docker settings, enabling a limited Denial of Service. The NVD entry assigns CVSS 3.1 v3.1 base sco...

WordPress Popup Box plugin <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update vulnerability

Missing Authorization to Unauthenticated Limited Options Update vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Popup box versions = 4.9.7...

CVE-2024-10897

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...

Vulnerabilities fixed in Citrix Session Recording

Citrix fixed vulnerabilities in Citrix Session Recording A malicious person with limited privileges could exploit the vulnerabilities to gain access to service accounts and execute arbitrary code on the server. Researchers have published Proof-of-Concept code demonstrating the vulnerability with...