3756 matches found
PT-2026-89850
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD Server/VMAP.php, which is reachable without authentication when the AD Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset...
CVE-2026-88924
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check...
PT-2026-89380
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter...
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service allows attackers to bypass authentication by using a user-controlled key, enabling them to escalate their privileges.
The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to the bypassing of authentication processes by using a user-controlled key. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...
CVE-2026-85981
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
CVE-2026-85982
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
CVE-2026-85983
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...
CVE-2026-85983 Local Privilege Escalation in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...
EUVD-2026-74188
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...
CVE-2026-85983 Local Privilege Escalation in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...
CVE-2026-85983
CVE-2026-85983 is a local privilege escalation in the Auth0 AD/LDAP Connector . The connector improperly processes a configuration value during service startup, allowing a low-privileged user on the host to modify the connector's configuration. Upon service restart, the altered configuration can ...
CVE-2026-85982
The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...
EUVD-2026-74186
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
CVE-2026-85981
The Auth0 AD/LDAP Connector (versions 6.5.0 and earlier ) has an unauthenticated administrative panel that listens on the local loopback interface without requiring credentials. A local, low-privileged user or process on the host can access the panel's management endpoints to read configuration d...
CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
EUVD-2026-74185
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...