A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.
A vulnerability in Apache Directory LDAP API versions 1.2.0 up to but not including 1.2.9 allows a malicious peer or man-in-the-middle to trigger excessive memory allocation via a crafted BER-encoded response. This can cause the client JVM to run out of memory (OutOfMemoryError), resulting in denial of service. The issue is fixed in version 1.2.9.
A stack overflow vulnerability exists in Apache Directory LDAP API versions from 1.2.0 up to but not including 1.2.9. This flaw is triggered when a client sends a deeply nested search filter before binding, causing the server's decoder to overflow the stack. The vulnerability has a CVSS score of 7.3 and impacts confidentiality, integrity, and availability. Users should upgrade to version 1.2.9, which contains the fix.
A deserialization of untrusted data vulnerability exists in Apache Directory LDAP API versions from 2.1.0 up to but not including 2.1.9, as well as certain 1.0.0 and 2.1.2 builds. A malicious or compromised LDAP server can respond to a client's loadSchema() subschema search with a schema object containing a serialized Java class, potentially enabling remote code execution. The issue is fixed in version 2.1.9.
CVE-2026-103878 is a vulnerability in Apache Directory LDAP API versions 2.1.0 up to but not including 2.1.9. It allows sensitive information to be transmitted in cleartext due to insufficient verification of data authenticity during a StartTLS operation initiated after a Search request. This issue is fixed in version 2.1.9.
An asymmetric resource consumption vulnerability exists in Apache Directory LDAP API versions from 2.1.0 up to but not including 2.1.9, as well as certain 1.0.0 and 2.1.2 builds. This flaw can cause an LDAP server using the API to consume 100% of a CPU core indefinitely when processing specially crafted telephone numbers. The issue is resolved in version 2.1.9.
An asymmetric resource consumption vulnerability exists in Apache Directory LDAP API versions from 2.1.0 before 2.1.9. When storing a password using the bcrypt algorithm with a high computational cost factor (e.g., 30), the LDAP server's CPU can be heavily taxed for extended periods, potentially leading to denial of service. The issue is fixed in version 2.1.9.
Apache Thrift Python bindings prior to version 0.25.0 have a vulnerability involving allocation of resources without limits or throttling and initialization of a resource with insecure defaults. This flaw can lead to resource exhaustion or other security issues. The issue is fixed in version 0.25.0. Users should upgrade to this version to mitigate the risk.
A vulnerability in Apache Thrift Lua bindings allows allocation of resources without limits or throttling due to improper handling of length parameter inconsistency. This affects versions before 0.25.0. The issue is fixed in version 0.25.0, and users are advised to upgrade.
Apache Thrift Java bindings prior to version 0.25.0 contain a vulnerability caused by improper handling of exceptional conditions, including allocation of resources without limits and uncaught exceptions. This can lead to resource exhaustion or application instability. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-59662 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. The vulnerability affects the 'nomCompetidor' parameter at the '/es/competitors/store' endpoint. Exploitation could allow an attacker to execute arbitrary code in a victim's browser by tricking the user into interacting with malicious input. The vulnerability has a CVSS 4.8 score indicating moderate impact. No patch or remediation information is currently provided.
CVE-2026-59664 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. The vulnerability affects the 'nomServicioPrestado' parameter at the '/es/providedservices/store' endpoint. Exploitation could allow an attacker to execute arbitrary code in a victim's browser by tricking the user into interacting with malicious content.
CVE-2026-59663 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. The vulnerability affects the 'nomDelegacion' parameter at the '/es/delegations/store' endpoint. Exploitation could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. The vulnerability has a CVSS 4.8 score indicating moderate risk. No patch or remediation information is currently provided.
Red Hat has issued a security update for Red Hat Hardened Images RPMs addressing a vulnerability identified as CVE-2026-17084 in python3.10 packages. The update includes multiple python3.10-related RPMs for aarch64 and x86_64 architectures. No specific details about the nature of the vulnerability or its exploitation are provided. The severity is assessed as medium.
CVE-2026-104403 is an authorization bypass vulnerability in ThimPress LearnPress that arises from user-controlled keys allowing incorrect access control. It affects LearnPress versions up to 4.4.9. The vulnerability has a medium severity with a CVSS score of 5.3 and does not require user interaction or privileges to exploit. There is no information about available patches or vendor advisories at this time.
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”.
CVE-2026-59661 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. It affects the 'nomRuta' parameter at the '/es/routes/update/693' endpoint. Exploitation could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. No affected versions or patch information are provided.
CVE-2026-59660 is a Cross-Site Scripting (XSS) vulnerability in the Repasat application affecting the 'nomTransportista' parameter at the '/es/carriers/update' endpoint. This flaw allows an attacker to execute arbitrary code in a victim's browser by tricking the user. The vulnerability has a medium severity score of 4.8. No patch or remediation information is currently available from the vendor.