PT-2024-36447 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability in the /admin/delete subject.php endpoint. This vulnerability allows for potential exploitation by injecting malicious SQL code...

CVE-2024-54930

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletestudent.php...

CVE-2024-11501

CVE-2024-11501 concerns the WordPress Gallery plugin (versions

WordPress plugin SMS for Lead Capture Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2025-3061

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A possible ABBA deadlock vulnerability has been identified in the Linux kernel, specifically in the netfilter IDLETIMER module. This issue occurs when the deletion of the last rule referencing ...

PT-2024-16998 · WordPress · Cluevo Lms

Name of the Vulnerable Software and Affected Versions: CLUEVO LMS, E-Learning Platform plugin for WordPress versions up to, and including, 1.13.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the cluevo render module ui function...

CVE-2024-11398

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2024-11398

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2024-11398

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2024-11398

CVE-2024-11398 affects Synology Router Manager (SRM) prior to version 1.3.1-9346-9, via an improper limitation of a pathname in the OTP reset functionality (path traversal). The vulnerability could allow remote authenticated users to delete arbitrary files through unspecified vectors. Documented ...

CVE-2024-42449

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine...

CVE-2024-42455

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The...

kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A race condition between channel deletion and timeout handling can lead to a null-pointer dereference in the l2capchantimeout function. A local attacker with low privileges could exploit...

Synology Router Manager 路径遍历漏洞

Synology Router Manager SRM is a software used to configure and manage Synology routers from China-based Synology Inc. A path traversal vulnerability exists in Synology Router Manager SRM versions prior to 1.3.1-9346-9, which stems from improperly restricting path names. An attacker could exploit...

CVE-2024-11844

The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ideapushtaxonomysaveroutine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above...

ADC: Unable to delete backup files from GUI

Customer sees 50 backup files on NetScaler GUI whereas same files are not visible on /var/nssysbackup directory. Whenever trying to delete the backup files from GUI it shows "ERROR: Backup file does not exist."...

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...

Oracle Linux 8 : kernel:4.18.0 (ELSA-2024-10281)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10281 advisory. - media: edia: dvbdev: fix a use-after-free Kate Hsuan RHEL-35763 CVE-2024-27043 - bpf: Add BPFPROGTYPECGROUPSKB attach type enforcement in...

Cross-site Request Forgery (CSRF)

wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient request validation, allowing attackers to arbitrarily delete user accounts via the /account/delete endpoint...

CVE-2024-10521

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...