OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JNDI. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68738)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows/Windows Server. The vulnerability stems...

Apache Archiva Injection Vulnerability (CNVD-2020-44097)

Apache Archiva is a suite of software from the Apache USA Software Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. A security vulnerability exists in Apache Archiva...

Mattermost Server Injection Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.2.0. An attacker can exploit the vulnerability by injecting to read LDAP fields...

PT-2020-8006

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.0.0 Description: An issue was discovered in the software, which has a superfluous API. This API allows the System Admin to change the account name and e-mail address of an LDAP account. Recommendations: F...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

GHSA-QMQC-X3R4-6V39 Polymorphic deserialization of malicious object in jackson-databind

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

DEBIAN-CVE-2020-1746

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldapattr and ldapentry community modules are used. The issue...

The vulnerability of the Astra Linux Directory Service’s EPPT management system, related to improper data processing, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an initialization processing error. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Astra Linux Directory service’s EPW management system, related to the escape of operations beyond the buffer in memory, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an error that causes operations to go beyond the memory limit. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Astra Linux Directory service’s EPP management system, which is related to insufficient verification of data authenticity, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an error in obtaining the Samba domain name from the server in console mode. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failur...

The vulnerability of the Astra Linux Directory service’s EPPT management system, related to improper access control, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an error in setting the integrity of directories. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Astra Linux Directory Service Management System (ALD) allows a violator to trigger a service failure by preventing resources from being released after their useful life has expired.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to the improper termination of software programs. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Astra Linux Directory service’s EPPT management system, related to improper authorization, allows a perpetrator to access confidential data and also trigger a service failure.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to an authentication error for local users. Exploiting this vulnerability can allow attackers to access confidential data and also cause service failures...

The vulnerability of the Astra Linux Directory Service Management System (ALD) allows a violator to trigger a service failure by preventing resources from being released after their useful life has expired.

The vulnerability of the Astra Linux Directory Service Management System ALD is related to the improper termination of software during operation. Exploiting this vulnerability can allow attackers to cause service failures...

UBUNTU-CVE-2020-10704

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerabilit...

Exploit for Missing Authentication for Critical Function in Vmware Vcenter_Server

Proof of concept for CVE-2020-3952https://www.guardicore.co...

The vulnerability of the VMware Directory Service (vmdir), a management service for virtual infrastructure, allows a attacker to escalate their privileges.

The vulnerability of the VMware Directory Service vmdir, a component of the VMware vCenter Server virtualization infrastructure management tool, is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Critical VMware Bug Opens Up Corporate Treasure to Hackers

A critical information-disclosure bug in VMware’s Directory Service vmdir could lay bare the contents of entire corporate virtual infrastructures, if exploited by cyberattackers. The vmdir is part of VMware’s vCenter Server product, which provides centralized management of virtualized hosts and...

Denial Of Service (DoS)

XScreenSaver is vulnerable Denial of Service DoS. When a system is using a remote directory service for login credentials, a local attacker may be able to cause a network outage causing XScreenSaver to crash, unlocking the screen...