2326 matches found
Openfire has potential identity spoofing issue via unsafe CN parsing
Summary Identity spoofing in X.509 client certificate authentication in Openfire allows internal attackers to impersonate other users via crafted certificate subject attributes, due to regex-based extraction of CN from an unescaped, provider-dependent DN string. Analysis Openfire’s SASL EXTERNAL...
Ubuntu: Security Advisory (USN-7742-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
BIT-KYVERNO-2025-29778 Kyverno ignores subjectRegExp and IssuerRegExp
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by...
CVE-2025-41042
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataOptionmessage', 'dataOptionsubject' and 'dataOptiontemplatetype' parameters in /apprain/information/manage/emailtemplate/ad...
CVE-2025-9838
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataOptionmessage, dataOptionsubject, and dataOptiontemplatetype parameters in /apprain/information/manage/emailtemplate/add. An attacker can execute arbitrary JavaScript code in the context of a user's...
CVE-2025-41042: Improper Neutralization of Input During Web Page Generation
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataOptionmessage', 'dataOptionsubject' and 'dataOptiontemplatetype' parameters in /apprain/information/manage/emailtemplate/ad...
An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to any name in that extension regardless of its type. This means that an attacker could impersonate a 4-byte or 16-byte domain by getting a certificate for the corresponding IPv4 or IPv6 address (this would require the attacker to control that IP address, though).
...
CVE-2025-9838
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
CVE-2025-9838
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
CVE-2025-9838 itsourcecode Student Information Management System index.php sql injection
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
CVE-2025-9838
CVE-2025-9838 affects itsourcecode Student Information Management System 1.0. The vulnerability is an SQL injection in the unknown function of the file /admin/modules/subject/index.php caused by manipulation of the ID parameter. The issue can be exploited remotely and there are public exploit mat...
CVE-2025-9838 itsourcecode Student Information Management System index.php sql injection
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
itsourcecode Student Information Management System 安全漏洞
itsourcecode Student Information Management System is an open source student information management system from itsourcecode. A security vulnerability exists in itsourcecode Student Information Management System version 1.0, which is caused by SQL injection due to incorrect manipulation of the...
CVE-2025-9838: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly availab...
Linux Distros Unpatched Vulnerability : CVE-2025-32988
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN...
PT-2025-35639
Name of the Vulnerable Software and Affected Versions: itsourcecode Student Information Management System version 1.0 Description: A SQL injection issue exists in the file /admin/modules/subject/index.php due to manipulation of the ID argument. The attack can be launched remotely. The exploit is...
CLSA-2025-1756760036 gnutls: Fix of CVE-2025-32988
CVE-2025-32988: fix double-free vulnerability when exporting othernames in SAN...