4659 matches found
MS07-039: Microsoft Windows Active Directory LDAP Service Remote Code Execution (926122)
The remote version of Active Directory contains a flaw in the LDAP request handler code that allows an attacker to execute code on the remote host. On Windows 2000 an anonymous attacker can exploit this flaw by sending a specially crafted LDAP packet. On Windows 2003 valid credentials are needed ...
Information disclosure
MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...
CVE-2007-3275
MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...
CVE-2007-3275
MailWasher Server (pre-2.2.1) with LDAP/AD improperly handles blank passwords, enabling remote access to arbitrary user accounts and exposure of stored spam emails. The issue is associated with LoginCheck::doPost in mwi/servlet/Login.cpp. Connected sources corroborate the affected software/versio...
CVE-2007-3275
MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...
Code injection
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...
CVE-2007-2999
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...
CVE-2007-2999
Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...
CVE-2007-2999
CVE-2007-2999 affects Microsoft Windows Server 2003 where time-restricted user accounts produce different error messages for failed logins with valid usernames versus invalid usernames. This behavior enables context-dependent attackers to enumerate valid Active Directory account names. The vulner...
Microsoft活动目录登录用户名枚举漏洞
Microsoft Active Directory是一款目录服务，可以实现整个网络的集中式安全管理。。 Microsoft Active Directory存在一个设计缺陷，远程攻击者可以利用漏洞枚举用户名信息。 如果通过Windows终端服务提供合法的用户名，根据域控制器返回的错误消息不同，可导致获得用户名是否存在信息。不过此漏洞只存在于用户帐户被设置了时间限制和这些帐户只有在这些时间里访问才存在。 Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard...
Microsoft Windows Active Directory users account enumeration
It's possible to enumerate accounts with Logon Hours limitation set...
[Full-disclosure] Microsoft Windows Active Directory Logon Hours User Enumeration Weakness
Windows Server 2003 can be configured http://support.microsoft.com/kb/816666 to restrict the hours and days that a user may log on to a Windows Server 2003 domain. This could lead to username enumeration. Issue:- Microsoft Windows Active Directory Username Enumeration Criticality:- Less Critical...
Authorization
KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...
CVE-2007-2849
KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...
CVE-2007-2849
KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...
CVE-2007-2849
The CVE-2007-2849 entry affects KnowledgeTree Document Management (KnowledgeTree Open Source) prior to STABLE 3.3.7. The vulnerability allows an unregistered user to log in if the user exists in Active Directory, bypassing the intended authorization check and enabling remote login to KTDMS. Affec...
CVE-2007-2849
KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...
CVE-2007-2476
Unspecified vulnerability in Novell SecureLogin NSL 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory AD password changes...