586 matches found
CVE-2022-46337
A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was...
PT-2023-8191
Name of the Vulnerable Software and Affected Versions Apache Derby versions prior to 10.17.1.0 Description A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. ...
ManageEngine ServiceDesk Plus MSP < 10.6 Build 10611 / 13.0 Build 13004
The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 10.6 Build 10611, 13.0 Build 13004. It is, therefore, affected by a vulnerability as referenced in the service-desk-mspcve-2023-22964 advisory. - Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x...
LDAP authentication fails with error "user <username> not found" if using UPN to login Gateway
LDAP authentication fails if using UPN userPrincipalName to login Gateway. When running /tmp/aaad.debug log on NetScaler, the following error "user @domainname.com not found" is printed in logs. /usr/home/build/adc/usr.src/netscaler/aaad/ldapdrv.c528: receiveldapusersearchevent 0-2: ldapfirstentr...
Configuring Gateway nfactor authentication with Radius first & LDAP second
Describe how to configure Citrix Gateway appliance to use RADIUS authentication as first factor and LDAP authentication as second factor The Storefront - Gateway Integration should be in place using 'Domain' Logon type in the Gateway configuration in the menu 'Manage Citrix Gateway'...
CVE-2023-4501
User authentication with username and password credentials is ineffective in OpenText Micro Focus Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server including product variants such as Enterprise Test Server, versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and...
PT-2023-29350 · Opentext · Enterprise Developer +3
Name of the Vulnerable Software and Affected Versions: OpenText Micro Focus Visual COBOL versions 7.0 patch updates 19 and 20 OpenText Micro Focus Visual COBOL versions 8.0 patch updates 8 and 9 OpenText Micro Focus Visual COBOL version 9.0 patch update 1 OpenText Micro Focus COBOL Server version...
ldap test randomly fails through SSL_TCP Load Balancing Vserver on NetScaler
The customer configured ldap authentication through NetScaler SSLTCP LB Vserver for backend ldap server. Customer found ldap test fails randomly...
PT-2023-9201 · Tp Link · Tp-Link Omada Er605
Name of the Vulnerable Software and Affected Versions: TP-Link Omada ER605 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. The flaw exists within the handling of the...
CVE-2023-3266
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an...
Authentication flaw
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an...
Denial of service
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed i...
Vault's LDAP Auth Method Allows for User Enumeration
Summary The Vault and Vault Enterprise “Vault” LDAP auth method allows unauthenticated users to potentially enumerate valid accounts in the configured LDAP system by observing the response error when querying usernames. This vulnerability, CVE-2023-3462, is fixed in Vault 1.14.1 and 1.13.5...
CVE-2023-28623 Unauthorized user can register an account in specific configurations in Zulip
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: ZulipLDAPAuthBackend and an external authentication backend any aside of ZulipLDAPAuthBackend and EmailAuthBackend are the only ones enabled in AUTHENTICATIONBACKENDS in /etc/zulip/settings.py...
User enumeration security issue when external authentication server is used
h3. Issue Summary This is reproducible on all Atlassian on-prem products that use LDAP or any other external server for authentication. It is possible to find out which usernames exists in the system and which do not exist by studying the response times it takes for a server to process a login...
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
Lenovo XClarity Controller (XCC) Vulnerabilities - Lenovo Support US
No description provided...
PT-2023-9834
Name of the Vulnerable Software and Affected Versions pgadmin affected versions not specified Description A vulnerability was found in pgadmin, where users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attemp...
SUSE CVE-2006-0150
Multiple format string vulnerabilities in the authldaplogreason function in Apache authldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username...