CVE-2025-24789

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write...

Authentication Bypass

Keycloak is vulnerable to Authentication Bypass. The vulnerability is due to the system updating passwords without performing an LDAP bind to validate the new credentials against Active Directory, allowing users with expired or disabled AD accounts to regain access and bypass AD restrictions...

PT-2025-5446 · Smackcoders · Smackcoders Wp Ultimate Exporter

Name of the Vulnerable Software and Affected Versions: Smackcoders WP Ultimate Exporter versions n/a through 2.9 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows Absolute Path Traversal. This means th...

CVE-2025-0604

CVE-2025-0604 is a Keycloak authentication bypass vulnerability where, after an AD password reset, Keycloak updates credentials without performing an LDAP bind to validate them against AD. This can allow access for accounts that are expired or disabled, bypassing AD restrictions. Public details i...

CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...

CVE-2025-24456

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping...

Siemens Mendix 注入漏洞

Mendix LDAP is a client-side implementation of the Lightweight Directory Access Protocol LDAP that allows your application to communicate with an LDAP server, such as the local Microsoft Active Directory AD. An injection vulnerability exists in Siemens Mendix LDAP, which can be exploited by an...

Siemens Mendix LDAP Injection Vulnerability

Mendix LDAP is a client-side implementation of the Lightweight Directory Access Protocol LDAP that allows your application to communicate with an LDAP server, such as the local Microsoft Active Directory AD. An injection vulnerability exists in Siemens Mendix LDAP, which can be exploited by an...

The vulnerability of the LDAP protocol implementation in the Samba network communication software allows a hacker to increase their privileges.

The vulnerability of the LDAP protocol implementation in the Samba network communication software package is related to deficiencies in access control based on Access Control Lists ACLs. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

CVE-2024-12106

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings...

PT-2024-17442 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.2 Description: An unauthenticated attacker can configure LDAP settings in WhatsUp Gold. Recommendations: For versions prior to 2024.0.2, update to version 2024.0.2 or later to resolve the issue. As a...

UBUNTU-CVE-2024-56619

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfsfindentry Syzbot reported that when searching for records in a directory where the inode's isize is corrupted and has a large value, memory access outside the folio/page...

The vulnerability of the `ldap_search_dn` function in the `mainfunction.cgi` script of the DrayTek Vigor router’s web interface allows a hacker to execute arbitrary commands.

The vulnerability of the ldapsearchdn function in the mainfunction.cg script of the DrayTek Vigor router’s web interface is related to the lack of measures taken at the control level to clean data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2024-17446 · Opentext · Opentext Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: OpenText Privileged Access Manager versions 23.34.4 through 24.34.5 Description: In a specific scenario, a LDAP user can abuse the authentication process in OpenText Privileged Access Manager, allowing authentication bypass. Recommendations:...

The vulnerability of Veeam Backup & Replication’s virtual and physical systems arises from the limited ability to restrict the path name to the restricted access directory. This allows attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of Veeam Backup & Replication virtual and physical systems is related to the limited ability to access the directory. Exploiting this vulnerability can allow a malicious actor to influence the integrity and accessibility of the protected information...

CVE-2024-54382

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Traversal.This issue affects Bold Page Builder: from n/a through = 5.1.5...

The vulnerability in the implementation of the LDAP service protocol for Microsoft Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in Microsoft Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability in the implementation of the LDAP service protocol for Windows operating systems allows a perpetrator to cause a service failure.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in Windows operating systems is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability in the implementation of the LDAP service protocol for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

CVE-2024-54259

CVE-2024-54259 concerns the WordPress DELUCKS SEO plugin. Connected sources corroborate an authenticated path traversal leading to arbitrary file access/read in versions n/a–2.5.5 (as per initial description) and extend to an arbitrary file download/vector in later updates (DELUCKS SEO