PT-2025-39395

Name of the Vulnerable Software and Affected Versions Rapid7 Appspider Pro versions prior to 7.5.021 Description The application has a broken access control issue in how it loads configuration files. Standard users can add custom configuration files, which are loaded alphabetically and can overri...

ROS-20250923-15

Vulnerability of LDAP protocol implementation of Samba networking software package is related to flaws in access control list ACL based access delimitation. Exploitation of the vulnerability could allow an attacker acting remotely to escalate privileges...

Design and Development of an Intelligent LLM-Based LDAP Honeypot

Cybersecurity threats continue to increase, with a growing number of previously unknown attacks each year targeting both large corporations and smaller entities. This scenario demands the implementation of advanced security measures, not only to mitigate damage but also to anticipate emerging...

CVE-2025-35431

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1...

The vulnerability in the `apply.cgi` script of the Linksys E1500 and E2500 router microprogramming system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the apply.cgi script of the Linksys E1500 and E2500 router microprogramming system is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected informati...

CVE-2025-35431 CISA Thorium LDAP injection

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1...

CISA Thorium 安全漏洞

CISA Thorium is a highly scalable distributed malware analysis and data generation framework for the U.S. Cybersecurity and Infrastructure Security Administration CISA government division. A security vulnerability exists in CISA Thorium versions prior to 1.1.1 that stems from unescaped...

PT-2025-38230

Name of the Vulnerable Software and Affected Versions: Thorium versions prior to 1.1.1 Description: Thorium does not escape user-controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data, such as group memberships. Recommendations: Update to...

CVE-2025-10224 Incorrect Evaluation of LDAP Nested Groups during Login in AxxonSoft Axxon One (C-Werk)

Improper Authentication CWE-287 in the LDAP authentication engine in AxxonSoft Axxon One C-Werk 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login...

CVE-2025-57392

BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILEALLACCESS, allowing local users to replace or modify .exe and .dll files. This may lead to privilege escalation or arbitrary code execution upon...

CVE-2025-48208

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary...

CVE-2025-48208 Apache HertzBeat (incubating): Jmx JNDI injection vulnerability

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary...

CVE-2025-48208 Apache HertzBeat (incubating): Jmx JNDI injection vulnerability

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary...

Apache HertzBeat 注入漏洞

Apache HertzBeat is a tool from Apache USA that monitors various components. An injection vulnerability exists in Apache HertzBeat 1.7.2 and earlier versions, which stems from improper neutralization of special elements in an LDAP query, and could lead to an LDAP injection attack...

Mageia: Security Advisory (MGASA-2025-0222)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0222 Updated ceph packages fix vulnerability

Security regression CVE-2025-52555 that would have allowed an user to read, write and execute to any directory owned by root as long as they chmod 777 it...

Linux Distros Unpatched Vulnerability : CVE-2024-1525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all version...

CVE-2025-48343

CVE-2025-48343 refers to a CSRF to Stored XSS vulnerability in the WordPress plugin WPMU Ldap Authentication (affected: versions

Linux Distros Unpatched Vulnerability : CVE-2022-32745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a...

Linux Distros Unpatched Vulnerability : CVE-2022-0730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. CVE-2022-0730 Note that Nessus relies on the presence of the...