15985 matches found
Red Hat Keycloak input validation vulnerability
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An input validation error vulnerability exists in Red Hat Keycloak that originates from a vulnerability that allows an attacker to perform othe...
Kashipara E-learning Management System Security Vulnerabilities
Kashipara E-learning Management System is a learning management system from Kashipara Inc. A security vulnerability exists in Kashipara E-learning Management System version 1.0 that stems from vulnerability to a stored cross-site scripting attack, which allows remote attackers to execute arbitrar...
Kashipara E-learning Management System Cross-site Scripting Vulnerabilities
Kashipara E-learning Management System is a learning management system from Kashipara Inc. A cross-site scripting vulnerability exists in Kashipara E-learning Management System version 1.0, which is rooted in a stored cross-site scripting attack that allows remote attackers to execute arbitrary...
CVE-2024-50833: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters...
PT-2024-34435
Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A Stored Cross-Site Scripting XSS issue was discovered in the /admin/admin user.php endpoint, allowing remote attackers to execute arbitrary scripts via the firstname and...
CVE-2024-50823: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters...
CVE-2024-50837: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting XSS vulnerability was found in /admin/adminuser.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and username parameters...
CVE-2022-2232: Improper Input Validation
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...
PT-2025-1529 · Ibm · Ibm Sterling File Gateway
Name of the Vulnerable Software and Affected Versions: IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.5 IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.1 Description: The issue is related to an observable discrepancy in request responses, which could allow an authenticated user...
CVE-2024-45875
The create user function in baltic-it TOPqw Webportal 1.35.287.1 fixed in version1.35.291, in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries...
GHSA-CG23-QF8F-62RR Symfony has an Authentication Bypass via RememberMe
Description When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Resolution The PersistentRememberMeHandler class now ensures the submitted username is the...
DEBIAN-CVE-2024-51996
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...
Authentication Bypass
Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to...
CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...
python-django: Username enumeration through timing difference for users with unusable passwords
A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...
Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.3 (python-django) security update
An update for python-django is now available for Red Hat OpenStack Platform 18.0.3 Feature Release 1 Antelope. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
PT-2024-31827
Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290 Description The create user function in the baltic-it TOPqw Webportal is vulnerable to SQL injection. This issue affects the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoin...
CVE-2024-45875
The baltic-it TOPqw Webportal version 1.35.287.1 is vulnerable to SQL injection within the create user function, specifically at the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint. The root cause is the improper neutralization of special elements where the JSON object username allows fo...
Symphony Communication Services Hp Symphony security vulnerabilities
Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony that stems from the fact that when using a persistent...
CVE-2024-45875: Improper Neutralization of Special Elements used in an SQL Command
The create user function in baltic-it TOPqw Webportal 1.35.287.1 fixed in version1.35.291, in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries...