Secure SSL flag does not work when using Delegated LDAP

h3. Summary The Secure SSL flag under the Advanced Settings section in the LDAP settings does not work when using Delegated LDAP/Internal with LDAP Authentication in JIRA. h3. Steps to Reproduce Add a Delegated LDAP AD in JIRA Checking the Secure SSL checkbox and hit the Save and Test button if w...

CVE-2016-1416

Cisco Prime Collaboration Provisioning 10.6 SP2 aka 10.6.0.10602 mishandles LDAP authentication, which allows remote attackers to obtain administrator privileges via a crafted login attempt, aka Bug ID CSCuv37513...

CVE-2016-3223

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle LDAP authentication, which allows man-in-the-middle attackers to gain privileges by modifying group-policy update da...

CVE-2016-3223

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle LDAP authentication, which allows man-in-the-middle attackers to gain privileges by modifying group-policy update da...

CVE-2016-3223

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle LDAP authentication, which allows man-in-the-middle attackers to gain privileges by modifying group-policy update da...

Dual Password Field wrongly shows in First Authentication Prompt when connecting to NetScaler Gateway using Receiver

Consider the following scenario, you are using LDAP + SMS passcode RADIUS authentication. The behavior is that user will first authenticate to LDAP, and then an SMS passcode is sent to their mobile device, which is used for authentication. Unless the user is authenticated to LDAP first, they will...

CVE-2002-2043

SQL injection vulnerability in the LDAP and MySQL authentication patch for Cyrus SASL 1.5.24 and 1.5.27 allows remote attackers to execute arbitrary SQL commands and log in as arbitrary POP mail users via the password...

CVE-2015-4322

Cisco Content Security Management Appliance SMA 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, a...

Palo Alto Networks PAN-OS 7.0.0 LDAP Authentication Bypass (PAN-SA-2015-0005)

The remote host is running Palo Alto Networks PAN-OS version 7.0.0. It is, therefore, affected by an unspecified flaw in the LDAP authentication process. A remote attacker can exploit this to bypass authentication checks presented by the captive portal component or the device management interface...

Device management authentication bypass

Devices running PAN-OS 7.0.0 including Panorama that are configured to use LDAP for captive portal or device management authentication do not properly perform authentication against the LDAP server in specific cases, leading to an authentication bypass. There is no issue if you are using Radius o...

Debian DLA-265-2 : pykerberos regression update

It was discovered that the original fix did not disable KDC verification support by default and changed checkPassowrd's signature. This update corrects this. This was the text of the original advisiory : Martin Prpic has reported the possibility of a man-in-the-middle attack in the pykerberos cod...

DLA-265-1 pykerberos - security update

Bulletin has no description...

CVE-2015-0546

EMC Unified Infrastructure Manager/Provisioning UIM/P 4.1 allows remote attackers to bypass LDAP authentication by providing a valid account name...

Authentication flaw

EMC Unified Infrastructure Manager/Provisioning UIM/P 4.1 allows remote attackers to bypass LDAP authentication by providing a valid account name...

[ MDVSA-2015:185 ] dokuwiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:185 http://www.mandriva.com/en/support/security/ Package : dokuwiki Date : March 31, 2015 Affected: Business Server 1.0 Problem Description: Updated dokuwiki packages fix security vulnerabilities:...

MGASA-2015-0181 Updated cherokee packages fix CVE-2014-4668

Updated cherokee packages fix security vulnerability: The cherokeevalidatorldapcheck function in validatorldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty...

Debian DLA-79-1 : dokuwiki security update

This fixes a possibility of bypassing the wiki authentication when an Active Directory is used for LDAP authentication. These two CVE are almost the same, one apparently being a superset of the other. They are fixed together. CVE-2014-8763 DokuWiki before 2014-05-05b, when using Active Directory...

CAS Server 3.5.2 LDAP Authentication Bypass Vulnerability

CAS Server version 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. Reporter: José Tozo =====Table of Contents================================== 1...

CAS Server 3.5.2 LDAP Authentication Bypass

=====Alligator Security Team - Security Advisory======== CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. Reporter: José Tozo =====Table of Contents================================== 1. Background 2. Detailed description 3. Other contex...

SysAid Server Arbitrary File Disclosure Vulnerability

SysAid Server is vulnerable to an unauthenticated file disclosure attack that allows an anonymous attacker to read arbitrary files on the system. An attacker exploiting this issue can compromise SysAid user accounts and gain access to important system files. When SysAid is configured to use LDAP...