PT-2023-4568

Name of the Vulnerable Software and Affected Versions Google Guava versions 1.0 through 31.1 Description The issue is related to the use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava. This allows other users and apps on the machine with access t...

Design/Logic Flaw

Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected...

Design/Logic Flaw

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...

Insecure Direct Object References (IDOR)

manager-workflow is vulnerable to Insecure Direct Object References IDOR. The vulnerability exists due to improper authentication mechanism used in ProcessServiceImpl.java when operating a workflow, which allows an attacker to access files or directories and cancel an application that doesn't...

The vulnerability of the C-Bus Toolkit software exists due to an incorrect limitation on the path name to the restricted access directory. This allows a perpetrator to execute arbitrary code.

The vulnerability of the C-Bus Toolkit software exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-2766

Weaver OA 9.5 is affected by CVE-2023-2766, caused by processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini that can lead to files or directories becoming accessible. The issue is exploitable remotely and has public disclosures noted in multiple sources (e.g., NVD a...

The vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) for the development environment and management of streaming applications like Apache StreamPark allows a malicious actor to gain access to read, modify, or delete data, thereby increasing their privileges.

The vulnerability of the LDAP protocol implementation in the development environment of Apache StreamPark, a streaming application management system, is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow an attacker operating remotely t...

CVE-2023-32978

A cross-site request forgery CSRF vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials...

The vulnerability of the connection method to the LDAP server lies in the LDAP connector of the Java Remote Connector Server (RCS) and the OpenIDM identity management system. This vulnerability stems from the lack of protection for the transmitted data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the LDAP connection method lies in the lack of protection for the data transmitted. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...

Remote code execution

Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

CVE-2023-28283 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

Microsoft Lightweight Directory Access Protocol 安全漏洞

Microsoft Lightweight Directory Access Protocol LDAP is a directory services protocol from Microsoft Corporation USA that runs on a layer above the TCP/IP stack. A security vulnerability exists in Microsoft Windows LDAP - Lightweight Directory Access Protocol. The following products and versions...

Apache StreamPark 注入漏洞

Apache StreamPark is a streaming media application development framework from the Apache Foundation. Apache StreamPark suffers from an injection vulnerability that stems from the presence of an LDAP injection vulnerability...

389-ds:1.4 bug fix update

An update is available for 389-ds-base, module.389-ds-base. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3...

UBUNTU-CVE-2023-0922

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection...

unboundid-ldapsdk: Incorrect Access Control vulnerability in process function in SimpleBindRequest class

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty...

SFTP path ~ resolving discrepancy

curl supports SFTP transfers. curl's SFTP implementation offers a special feature in the path component of URLs: a tilde character as the first path element in the path to denotes a path relative to the user's home directory. This is supported because of wording in the once proposed to-become RFC...

Debian: Security Advisory (DLA-203-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description High SECURITY-3037 / CVE-2023-27898 XSS vulnerability in plugin manager Medium SECURITY-3030 / CVE-2023-24998 upstream issue, CVE-2023-27900 MultipartFormDataParser, CVE-2023-27901 StaplerRequest DoS vulnerability in bundled Apache Commons FileUpload library...

SUSE CVE-2005-2301

PowerDNS before 2.9.18, when running with an LDAP backend, does not properly escape LDAP queries, which allows remote attackers to cause a denial of service failure to answer ldap questions and possibly conduct an LDAP injection attack...