Siemens SIMATIC S7-1500 Uncontrolled Recursion (CVE-2020-12243)

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service daemon crash. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable,...

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...

ROS-20251105-11

Zabbix universal monitoring system vulnerability is related to authorization errors. Exploitation vulnerability can allow a remote attacker to gain unauthorized access to protected information. protected information Vulnerability of Zabbix universal monitoring system is related to a logical error...

PT-2025-46821

Name of the Vulnerable Software and Affected Versions pgAdmin versions prior to 9.9 Description The software is susceptible to an LDAP injection issue within the LDAP authentication process. An attacker can inject specific LDAP characters into the username field. This manipulation forces the...

[SECURITY] Fedora 42 Update: sssd-2.11.1-2.fc42

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2023-53690

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...

CVE-2024-13999 Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...

CVE-2025-34280

The CVE-2025-34280 affects Nagios Network Analyzer versions prior to 2024R2.0.1. The LDAP certificate management feature fails to sanitize inputs, enabling an authenticated administrator to trigger remote code execution on the host within the web application service privileges. Impact is remote c...

CVE-2025-34270

CVE-2025-34270 affects Nagios Log Server versions prior to 2024R2.0.2, where the AD/LDAP user import path does not obfuscate the password field. The result is potential exposure of plaintext passwords for imported accounts in the user interface, logs, or other diagnostic output. The Red Hat and E...

CVE-2023-53690

Nagios Fusion (versions prior to 4.2.0) is affected by a stored XSS vulnerability in the LDAP/AD authentication-server configuration. The flaw arises from unsanitized input that can be stored and later rendered in the administrative UI, causing JavaScript execution in users’ browsers when viewing...

CVE-2025-62795

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket...

EUVD-2025-37046

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket...

GO-2025-4048 Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to Code Injection through its LDAP fields in github.com/mattermost/mattermost-server...

PT-2025-44500

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3 Description Nagios XI, under certain circumstances, reveals the server's Active Directory AD or Lightweight Directory Access Protocol LDAP authentication token to a user who is already authenticated. This...

Nagios Log Server 安全漏洞

Nagios Log Server is a suite of centralized log management, monitoring, and analysis software from Nagios, Inc. A security vulnerability exists in Nagios Log Server versions prior to 2024R2.0.2, which stems from a failure of the AD or LDAP user import function to obfuscate the password field, whi...

PT-2025-44520

Name of the Vulnerable Software and Affected Versions Nagios Network Analyzer versions prior to 2024R2.0.1 Description Nagios Network Analyzer contains a flaw in how it handles LDAP certificate management. Specifically, the certificate removal process does not properly sanitize input. An...

Nagios Network Analyzer 安全漏洞

Nagios Network Analyzer is an enterprise solution for monitoring and analyzing network traffic from Nagios, Inc. A security vulnerability exists in Nagios Network Analyzer versions prior to 2024R2.0.1, which stems from improper cleanup of inputs to the LDAP certificate management feature and coul...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.3 that stems from the disclosure of...

CVE-2025-62794

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

CVE-2025-62794 GitHub Workflow Updater stored the optional Github token in plaintext

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...