Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from US-based Mattermost. Mattermost suffers from a security vulnerability that stems from an inability to properly authorize a request to obtain the AD/LLDAP group associated with a team, which could allow an attacker to obtain the details of t...

The vulnerability in the implementation of the LDAP service protocol on Windows operating systems allows a perpetrator to cause a service failure.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2024-2725 · F5 · F5Os

Name of the Vulnerable Software and Affected Versions: F5OS affected versions not specified Description: The issue is related to the implementation of the LDAP protocol in F5OS, which is associated with deficiencies in the authorization mechanism. When LDAP remote authentication is configured, a...

USN-6596-1 libapache-session-ldap-perl vulnerability

It was discovered that Apache::Session::LDAP incorrectly handled invalid X.509 certificates. If a user or an automated system were tricked into opening a specially crafted invalid X.509 certificate, a remote attacker could possibly use this issue to perform spoofing and obtain sensitive informati...

keycloak: LDAP injection on username input

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

CVE-2023-6791

A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface...

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

PT-2023-22276 · Terminalfour · Terminalfour

Name of the Vulnerable Software and Affected Versions: Terminalfour versions prior to 8.3.16 Description: The issue allows misconfigured LDAP users to login with an invalid password. Recommendations: For versions prior to 8.3.16, update to version 8.3.16 or later to resolve the issue...

The vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) on the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the LDAP protocol implementation on the Windows operating system arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-38184

Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

YSoft SAFEQ 6 安全漏洞

YSoft SAFEQ 6 is an enterprise print management suite solution platform from the Czech company YSoft. A security vulnerability exists in YSoft SAFEQ 6 Server versions prior to 6.0.82, which stems from the fact that when changing the URL of an LDAP server configuration from LDAPS to LDAP, the syst...

GHSA-HR8G-6V94-X4M9 Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle provides the X509LDAPCertStoreSpi.java class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the...

RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute

A flaw was found in RHDS 11 and 12. While browsing entries, LDAP tries to decode the userPassword attribute instead of the userCertificate attribute, which could lead into sensitive information being leaked. This issue could allow an attacker with a local account with cockpit-389-ds running to li...

org.jenkins-ci.plugins:reverse-proxy-auth-plugin (>=1.3.3 <=1.6.3) potentially affected by CVE-2023-32978 via org.jenkins-ci.plugins:ldap (=1.8)

org.jenkins-ci.plugins:ldap MAVEN version =1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:ldap and may be impacted: - org.jenkins-ci.plugins:reverse-proxy-auth-plugin =1.3.3, =1.6.3 Source cves: CVE-2023-32978 Source advisor...

The vulnerability in the implementation of the LDAP Lightweight Directory Access Protocol on the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in the Windows operating system is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Lenovo XClarity Controller 安全漏洞

Lenovo XClarity Controller XCC is a server-embedded management engine from Lenovo China that is used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller that stems from the fact that under certain conditions, valid LDAP users wi...

PT-2023-22115 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: The issue concerns a scenario where a valid XCC user's local account permissions take precedence over their active directory permissions under specific configurations, potentially leading to a...

PT-2023-8259 · Nvidia · Nvidia Dgx H100 Bmc

Name of the Vulnerable Software and Affected Versions: NVIDIA DGX A100 BMC affected versions not specified Description: The issue is related to an LDAP user injection vulnerability in the NVIDIA DGX A100 BMC. This vulnerability may allow an attacker to cause information disclosure. The...

Mastodon 注入漏洞

Mastodon is an open source social network server based on ActivityPub. An injection vulnerability exists in Mastodon version 2.5.0 and later versions, which stems from an insecure LDAP query at login. An attacker can exploit this vulnerability to disclose arbitrary attributes of the LDAP database...

PT-2023-22009 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 2.5.0 through 3.5.7 Mastodon versions 3.5.8 is not affected, but versions prior to 3.5.8 are affected, however 4.0.3 and prior to 4.0.4 and 4.1.1 and prior to 4.1.2 are also affected. Mastodon versions 2.5.0 through 4.1.1...