PT-2024-29317

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 1.0 Responsive School Management System version 3.2.0 Description A Stored Cross Site Scripting XSS issue was found in the "/smsa/add class submit.php" endpoint, allowing remote attackers t...

Kashipara Responsive School Management System Cross-site Scripting Vulnerability

Kashipara Responsive School Management System is a school management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Responsive School Management System version v3.2.0, which stems from a stored cross-site scripting vulnerability contained in the...

CVE-2024-7500

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function savesettings of the file admin/adminclass.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. Th...

PT-2024-38390 · Itsourcecode · Itsourcecode Airline Reservation System

Name of the Vulnerable Software and Affected Versions: itsourcecode Airline Reservation System version 1.0 Description: A critical issue has been found in the itsourcecode Airline Reservation System, where the save settings function in the admin/admin class.php file is affected. The manipulation ...

jflex:JflexFuzzer: Security exception in jflex.core.NFA.insertNFA

Detailed Report: https://oss-fuzz.com/testcase?key=5488751948660736 Project: jflex Fuzzing Engine: libFuzzer Fuzz Target: JflexFuzzer Job Type: libfuzzerasanjflex Platform Id: linux Crash Type: Security exception Crash Address: Crash State: jflex.core.NFA.insertNFA...

classmgmt.com Cross Site Scripting vulnerability OBB-3953589

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

javaparser:parseFuzzer: Security exception in com.github.javaparser.GeneratedJavaParser.Expression

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=6197193074081792 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Security exception Crash Address: Crash...

CVE-2024-7389: Insufficiently Protected Credentials

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make...

Ruijie EG-2000SE Upload File

The vulnerability of the upload.php script in the UploadFile class of the Ruijie EG-2000SE gateway software relates to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability allows an attacker to remotely upload any type of files...

CVE-2024-42129

In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devmmutexinit for mutex initialization In this driver LEDs are registered using devmledclassdevregister so they are automatically unregistered after module's remove is done. ledclassdevunregister calls module's...

Telerik Report Server Code Execution

The vulnerability of the Telerik Report Server reporting management software lies in the use of external control for selecting classes when input data is provided. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-4410

CVE-2024-4410 — IgnitionDeck Crowdfunding Platform (WordPress) Affected: IgnitionDeck Crowdfunding Platform plugin for WordPress (

CVE-2024-4410: Missing Authorization

The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. This makes it possible for...

PT-2024-30951 · WordPress · Ignitiondeck Crowdfunding Platform

Name of the Vulnerable Software and Affected Versions: IgnitionDeck Crowdfunding Platform plugin for WordPress versions up to, and including, 1.9.8 Description: The issue is due to missing capability checks on various functions called via AJAX actions in the /classes/class-idf-wizard.php file. Th...

SUSE-SU-2024:2571-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-39371: iouring: check for non-NULL file pointer in iofilecanpoll bsc1226990. - CVE-2023-52846: hsr: Prevent use after free in prpcreatetaggedframe bsc122509...

GHSA-W36W-948J-XHFW H2O vulnerable to Deserialization of Untrusted Data

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

PT-2024-40821 · Jflex · Jflex

Name of the Vulnerable Software and Affected Versions: jflex affected versions not specified Description: A security exception crash has been reported. The crash occurs in the jflex.core.NFA.insertNFA function, which is called by java.base/java.lang.ClassLoader.defineClass1 and...

SolarWinds Access Rights Manager UserScriptHumster Arbitrary Command Execution

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager ARM access control software is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Triangle MicroWorks SCADA Data Gateway Information Disclosure Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product developed by Triangle MicroWorks, Inc. and is mainly used for data acquisition and monitoring in industrial automation control systems. Triangle MicroWorks SCADA Data Gateway suffers from an information disclosure vulnerabilit...

SolarWinds Access Rights Manager ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChangeHumster class. The issue results from an exposed dangerous...