304123 matches found
UBUNTU-CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...
CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
CVE-2026-103117
A security vulnerability exists in OS4ED openSIS-Classic up to version 9.3. The flaw is located in the db_properties function within the functions/DatabaseInc.php file of the Save Data Handler component. Improper handling of argument values allows for a remote SQL injection attack. While the expl...
EUVD-2026-89949
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
CVE-2026-88920
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...
CVE-2026-10739
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...
CVE-2026-103115 OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...
CVE-2026-103115
A security flaw exists in OS4ED openSIS-Classic up to version 9.3 within the Student Search component. Specifically, an unknown function in the file functions/CustomFieldsFnc.php is vulnerable to SQL injection when the cust argument is manipulated. This flaw can be triggered via a remote attack ....
CVE-2026-103115 OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...
CVE-2026-92899 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-92899 Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
EUVD-2026-89798
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-92899
The Apache WSS4J library is vulnerable to a replay protection bypass because it stores the Nonce of a UsernameToken as raw base64 text. While authentication uses the decoded bytes, an attacker can re-send a captured request with a space added to the base64 Nonce; the password digest remains valid...
CVE-2026-92899
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...
EUVD-2026-89779
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...
CVE-2026-103114
A SQL injection vulnerability exists in OS4ED openSIS-Classic up to version 9.3 . The flaw is located in the Assignment Management Endpoint within the DBQuery_assignment function of the modules/grades/Assignments.php file. An attacker can remotely initiate the attack by manipulating the Tables ar...