Jndi injection and Spring RCE vulnerability analysis-vulnerability warning-the black bar safety net

Foreword Because before has been traveling, and haven't done the research, eleven during the re-focus of the 2 0 1 6 BlackHat the above subject, wherein jndi injection caught my attention, this paper mainly divided into the following 3 sections, the understanding of jndi, analysis jndi injection...

The vulnerability of the Solaris operating system allows a perpetrator to compromise the integrity, accessibility, and confidentiality of information.

The vulnerability of the PAM LDAP module in the Solaris operating system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to compromise the integrity, accessibility, and confidentiality of information...

Samba LDAP Man-in-the-Middle Attack Vulnerability

Samba is a set of free software that enables the UNIX family of operating systems to connect to the SMB/CIFS network protocol of the Microsoft Windows operating system. Samba's LDAP implementation fails to enforce integrity protection on LDAP connections, allowing remote attackers to exploit this...

Samba DCE/RPC Protocol Security Downgrade Vulnerability

Samba is a set of free software that enables the UNIX family of operating systems to connect to the SMB/CIFS network protocol of the Microsoft Windows operating system. A security vulnerability in Samba's DCE/RPC protocol allows remote attackers to exploit this vulnerability to conduct denial of...

The vulnerability of the Windows operating system, which allows a hacker to inject arbitrary web or HTML code

The vulnerability of the Active Directory service for Windows operating systems exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code by manipulating the wct parameter...

libldb: remote memory read in the Samba LDAP server

A memory-read flaw was found in the way the libldb library processed LDB DN records with a null byte. An authenticated, remote attacker could use this flaw to read heap-memory pages from the server...

UBUNTU-CVE-2015-7540

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service memory consumption and daemon crash via crafted packets...

UBUNTU-CVE-2015-5330

ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading 1 an error message ...

MS15-096: Vulnerability in Active Directory Service Could Allow Denial of Service (3072595)

The remote Windows host is affected by a denial of service vulnerability in Active Directory that is triggered during the handling of a saturation of account creations. An authenticated, remote attacker, with privileges to join machines to a domain, can exploit this vulnerability by creating...

Foreman Man-in-the-Middle Attack Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman versions prior to 1.7.4, which stems from the program's failu...

EAP: LDAP bind password is being logged with TRACE log level

AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform EAP before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled...

The vulnerability of the Red Hat Enterprise Linux operating system, which allows a remote attacker to compromise the accessibility of protected information

The vulnerability of the openldap-clients-2.4.23 package for the Red Hat Enterprise Linux operating system can lead to a violation of the accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the CentOS operating system, which allows a malicious attacker to compromise the accessibility of protected information

The vulnerability of the openldap-clients-2.4.23 package for the CentOS operating system can lead to a violation of the accessibility of protected information. Exploitation of this vulnerability can be carried out remotely...

The vulnerability of the CentOS operating system allows a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the 389-ds-base-devel-1.2.11.15 package for the CentOS operating system can be exploited, leading to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely by a malicious individual who has completed...

IBM Domino LDAP Server Arbitrary Code Execution Vulnerability

IBM Domino formerly known as IBM Lotus Domino is a set of platforms for hosting social business applications from IBM in the United States. The platform combines business messaging, applications and social collaboration, and provides users with real-time online communication capabilities. A...

PT-2015-3394 · Samba +5 · Samba +5

Name of the Vulnerable Software and Affected Versions: Samba versions prior to 4.1.22 Description: The issue is related to the LDAP server in the AD domain controller in Samba, where it fails to check return values for successful ASN.1 memory allocation. This allows remote attackers to cause a...

IT-Grundschutz M5.147: Absicherung der Kommunikation mit Verzeichnisdiensten

IT-Grundschutz M5.147: Absicherung der Kommunikation mit Verzeichnisdiensten. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Cloudera Manager Saving Passwords in Plaintext Vulnerability

Cloudera Manager is a set of Hadoop data management software from Cloudera, USA. The software supports the creation of clusters, authentication, data backup and recovery and so on. Cloudera Manager has a security vulnerability. Since the program stores LDAP binding passwords in plaintext in a...

JAAS: LDAPLoginModule allows empty password authentication

It was found that if a configured LDAP server supported the unauthenticated authentication mechanism as described by RFC 4513, the LDAPLoginModule implementation, provided by ActiveMQ Java Authentication and Authorization Service JAAS, would consider an authentication attempt to be successful for...

CVE-2014-8825

The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, which allows local users to gain privileges or spoof directory-service responses via unspecified vectors...