CVE-2019-11204

The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected...

PT-2019-16752 · Red Hat +4 · 389-Ds-Base +5

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions 1.4.1.2 and earlier Description: The issue allows an unauthenticated attacker to create hanging LDAP requests, potentially hanging all worker threads and resulting in a Denial of Service. This occurs because connections...

The vulnerability of the LDAP service implementation in networking operating systems NX-OS and FX-OS on Cisco devices allows a hacker to induce a service failure.

The vulnerability of the LDAP service implementation in NX-OS and FX-OS networking operating systems on Cisco devices exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a restart of the vulnerable device and a service failur...

DEBIAN-CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to ma...

The vulnerability of the fly-admin-samba package for managing Samba network resources on the Astra Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fly-admin-samba package for managing Samba network resources on the Astra Linux operating system is related to a conflict in the way the package interacts with the Astra Linux Directory Service ALD. Exploiting this vulnerability could allow a malicious actor to cause...

The vulnerability of the ald-parse security extension of the ALD service in the Astra Linux operating system allows a attacker to cause a service failure.

The vulnerability of the ald-parse security extension of the ALD service in the Astra Linux operating system is related to an error in assigning access rights to the cache of token metadata for certain services. This leads to its continuous reallocation. Exploiting this vulnerability allows a...

The vulnerability of Astra Linux Directory service (ALD), a component of the Astra Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the Astra Linux Directory Service ALD in the Astra Linux operating system is related to an error in the command for accessing cache files of directory attributes. This error causes these files to be constantly recreated. Exploiting this vulnerability allows a malicious actor,...

DEBIAN-CVE-2018-14629

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service...

ALPINE-CVE-2018-14629

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service...

DEBIAN-CVE-2018-16851

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this siz...

USN-3827-1 samba vulnerabilities

Florian Stuelpner discovered that Samba incorrectly handled CNAME records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service. CVE-2018-14629 Alex MacCuish discovered that Samba incorrectly handled memory when configured to accept smart-card...

curl: LDAP NULL pointer dereference

A NULL pointer dereference flaw was found in the way libcurl checks values returned by the openldap ldapgetattributeber function. A malicious LDAP server could use this flaw to crash a libcurl client application via a specially crafted LDAP reply...

krb5: DN container check bypass by supplying special crafted data

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN stri...

GHSA-H5F5-RJ4R-42F6 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password...

UBUNTU-CVE-2018-14638

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in deletepasswdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service...

PT-2023-10677

Name of the Vulnerable Software and Affected Versions Samba affected versions not specified Description An information leak issue was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attribut...

Puppet Enterprise Plaintext Transfer Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A plaintext transfer vulnerability...

CVE-2018-11749

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS...

ALPINE-CVE-2018-10919

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are...

UBUNTU-CVE-2018-10919

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are...