Kashipara E-learning Management System Cross-site Scripting Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara Inc. A cross-site scripting vulnerability exists in Kashipara E-learning Management System version 1.0, which is rooted in a stored cross-site scripting attack that allows remote attackers to execute arbitrary...

CVE-2024-50833: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters...

PT-2024-34435

Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A Stored Cross-Site Scripting XSS issue was discovered in the /admin/admin user.php endpoint, allowing remote attackers to execute arbitrary scripts via the firstname and...

CVE-2024-50823: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters...

CVE-2024-50837: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability was found in /admin/adminuser.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and username parameters...

CVE-2022-2232: Improper Input Validation

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

PT-2025-1529 · Ibm · Ibm Sterling File Gateway

Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.5 IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.1 Description: The issue is related to an observable discrepancy in request responses, which could allow an authenticated user...

CVE-2024-45875

The create user function in baltic-it TOPqw Webportal 1.35.287.1 fixed in version1.35.291, in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries...

GHSA-CG23-QF8F-62RR Symfony has an Authentication Bypass via RememberMe

Description When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Resolution The PersistentRememberMeHandler class now ensures the submitted username is the...

DEBIAN-CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

Authentication Bypass

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to...

CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.3 (python-django) security update

An update for python-django is now available for Red Hat OpenStack Platform 18.0.3 Feature Release 1 Antelope. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2024-31827

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290 Description The create user function in the baltic-it TOPqw Webportal is vulnerable to SQL injection. This issue affects the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoin...

CVE-2024-45875

The baltic-it TOPqw Webportal version 1.35.287.1 is vulnerable to SQL injection within the create user function, specifically at the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint. The root cause is the improper neutralization of special elements where the JSON object username allows fo...

Symphony Communication Services Hp Symphony security vulnerabilities

Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony that stems from the fact that when using a persistent...

RHEL 9 : Red Hat OpenStack Platform 18.0.3 (python-django) (RHSA-2024:9481)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9481 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as muc...

CVE-2024-45875: Improper Neutralization of Special Elements used in an SQL Command

The create user function in baltic-it TOPqw Webportal 1.35.287.1 fixed in version1.35.291, in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries...

Siemens SCALANCE M-800 Family Improper Input Validation (CVE-2024-50560)

Affected devices truncates usernames longer than 15 characters when accessed via SSH or Telnet. This could allow an attacker to compromise system integrity. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...