The vulnerability of the UserFW component of the Junos operating system, which allows a hacker to gain access to the device

The vulnerability of the UserFW component used to facilitate easy implementation of user profiles through existing firewall policies in the Junos operating system exists due to the rigid encoding of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely...

Palo Alto Networks PAN-OS LDAP Authentication Bypass Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. An authentication bypass vulnerability exists in Palo Alto Networks PAN-OS. An attacker could use this vulnerability to bypass the authentication mechanism and perform unauthorized...

sysPass 1.0.9 - SQL Injection

sysPass 1.0.9 - SQL Injection -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-031 Product: sysPass Vendor: http://cygnux.org/ Affected Versions: 1.0.9 and below Tested Versions: 1.0.9 Vulnerability Type: SQL Injection CWE-89 Risk Level: High Solution Status: Fixed Vendor...

EMC Unified Infrastructure Manager/Provisioning Authentication Bypass Vulnerability

EMC Unified Infrastructure Manager is a manager built for converged infrastructures that automates the configuration, provisioning, viewing of topology, monitoring of events and availability. A security vulnerability exists in the use of LDAP authentication for EMC UIM configurations, which allow...

TYPO3 LDAP/SSO Authentication Extension Authentication Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. An authentication bypass vulnerability exists in the TYPO3 LDAP/SSO Authentication Extension, which can be exploited by an attacker to bypass the authentication mechanism and...

UBUNTU-CVE-2014-8764

DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null \0 character, which triggers an anonymous bind...

CVE-2013-0966

The Apple modhfsapple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI...

CVE-2013-0966

The Apple modhfsapple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

An update for JBoss Enterprise Application Platform 5.2.0 which fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which...

MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass

This module bypasses basic authentication for Internet Information Services IIS. By appending the NTFS stream name to the directory name in a request, it is possible to bypass authentication. This module requires Metasploit: https://metasploit.com/download Current source:...

A species vulnerability--IIS 5.1 Directory Authentication Bypass-vulnerability warning-the black bar safety net

Bugtraq ID: 4 1 3 1 4 CVE ID: CVE-2 0 1 0-2 7 3 1 CNCVE ID: CNCVE-2 0 1 0 2 7 3 1 Vulnerability published:2010-07-01 Vulnerability update time:2010-09-14 Vulnerability causes: access validation error Danger level: low Affected systems: Microsoft IIS 5.1 Hazard: a remote attacker can exploit the...

CVE-2010-2731

CVE-2010-2731 describes an issue in Microsoft IIS 5.1 on Windows XP SP3 where directory-based Basic Authentication can be bypassed, allowing remote execution of ASP files via a crafted request. The root cause is described in public sources as an authentication bypass related to NTFS stream handli...

CVE-2010-2731

Unspecified vulnerability in Microsoft Internet Information Services IIS 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka "Directory Authentication Bypass...

Microsoft IIS Directory Authentication Bypass (MS10-065; CVE-2010-1899; CVE-2010-2731)

IIS is a collection of Internet services packaged with several versions of the Windows operating system. An elevation of privilege vulnerability has been reported in Microsoft Internet Information Services IIS. The vulnerability is due to the way IIS parses specially crafted URLs. An attacker may...

IIS5.1 Directory Authentication Bypass by using “:$I30:$Index_Allocation”

Description: Although IIS5 is very old, finding one is not impossible! Therefore, I want to introduce a technique to bypass the IIS authentication methods on a directory. This vulnerability is because of using Alternate Data Stream to open a protected folder. All of IIS authentication methods can...

StartTLS not enabled in Hitachi Storage Command Suite products

Overview When a Hitachi Storage Command Suite product uses an LDAP directory server as the server to be used for external authentication, StartTLS won't be enabled even if it is specified as the connection protocol. Impact StartTLS won't be enabled even if it is specified as the connection...

PT-2009-5547 · Postgresql · Postgresql

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 8.2 through 8.2.14 PostgreSQL versions 8.3 through 8.3.8 Description: The issue allows remote attackers to bypass authentication via an empty password when using LDAP authentication with anonymous binds. If PostgreSQL is...

PT-2007-3787 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA and PIX versions 7.1 before 7.1249 Cisco Adaptive Security Appliance ASA and PIX versions 7.2 before 7.2217 Description: The issue allows remote attackers to cause a denial of service, resulting in a devi...