CVE-2024-34887

CVE-2024-34887 affects 1C-Bitrix Bitrix24 23.300.100. The issue is "insufficiently protected credentials" in AD/LDAP server settings, enabling remote administrators to exfiltrate AD/LDAP administrator passwords to an arbitrary server via HTTP POST. Public sources (Red Hat, CNNVD, CVE listings) de...

CVE-2024-34887

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request...

Exposure Of Sensitive Information To An Unauthorized Actor

Mattermost is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to a lack of proper authorization checks in the /api/v4/groups//channels//link endpoint, allowing users to learn members of an AD/LDAP group linked to a team by adding the group to a...

CVE-2024-34029

Mattermost versions 9.5.x /channels//link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team...

CVE-2024-34029 AD/LDAP Group Members Leak

Mattermost versions 9.5.x /channels//link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team...

CVE-2024-34029

Mattermost suffers an authorization bypass in /api/v4/groups//channels//link, allowing a user to learn members of an AD/LDAP group linked to a team without having access to that team. Affected are Mattermost Server/Mattermost releases: 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, and 8.1.x up to 8.1.12....

CVE-2024-34029: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost versions 9.5.x = 9.5.3, 9.7.x = 9.7.1 and 8.1.x = 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/ /channels/ /link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the use...

RHEL 7 : samba (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - samba: Symlink race error can allow directory creation outside of the exported share CVE-2021-43566 -...

RHEL 6 : samba (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - samba: Active Directory AD domain user could become root on domain members CVE-2020-25717 - samba:...

Improper Access Control

github.com/mattermost/mattermost/ is vulnerable to Improper Access Control. The vulnerability is due to inadequate authorization checks for requests fetching the team associated AD/LDAP groups. This enables users to retrieve details of AD/LDAP groups from teams they are not part of...

GHSA-7V3V-984V-H74R Mattermost leaks details of AD/LDAP groups of a teams

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CVE-2024-23493

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

Code injection

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorization

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CVE-2024-23493: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CentOS 9 : libldb-2.5.2-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libldb-2.5.2-1.el9 build changelog. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database...

NewStart CGSL MAIN 6.06 : libldb Vulnerability (NS-SA-2023-0133)

The remote NewStart CGSL host, running version MAIN 6.06, has libldb packages installed that are affected by a vulnerability: - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a...

Rocky Linux 9 : libldb (RLSA-2022:8318)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8318 advisory. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module,...

Medium: libldb

Issue Overview: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as...