EUVD-2026-72400

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76578

FreeIPA is affected by a critical flaw (CVSS 9.8 ) in its self-managed OTP token ACI , which does not require authentication and fails to restrict which attributes may be added alongside a token entry. Combined with a related flaw in the underlying directory server's ACI evaluation (tracked separ...

cve-2024-49113-ldap_nightmare_reproduction

CVE-2024-49113 — LDAP Nightmare Ejecución remota de código en el cliente LDAP de Windows desbordamiento de búfer basado en montón...

metasploit-ldapnightmare

metasploit-ldapnightmare PoC de SafeBreaches para CVE-2024-49113 LdapNightmare Integrado en Metasploit Resumen Este módulo implementa CVE-2024-49113, una vulnerabilidad crítica en el cliente LDAP de Windows que puede causar inestabilidad en el sistema. El módulo se integra con Metasploit Framewor...

LDAPMon

LDAPMon LDAPMon es un recopilador de telemetría POC para el proveedor ETW Microsoft-Windows-LDAP-Client. Una vez iniciado, los registros se almacenarán en el Visor de eventos. Este POC incluye un analizador de Sentinel para que, si desea recopilar estos datos dentro de un SIEM, pueda hacerlo. Se...

CVE-2024-49112

LDAP Nightmare Un exploit para CVE-2024-49112 reportado por Yuki Chen @guhe120. Una vulnerabilidad en el Protocolo Ligero de Acceso a Directorios LDAP de Windows. Creado por SafeBreach Labs publicado el 1 de enero de 2025. Para el análisis técnico completo de la vulnerabilidad y cómo logramos...

Improper Certificate Validation

The LDAP client is vulnerable to Improper Certificate Validation. The vulnerability is due to missing hostname verification during TLS server identity validation, where the LDAP client validates the certificate chain but does not verify that the certificate matches the intended LDAP server...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

CVE-2026-35563

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

CVE-2026-35563 Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

EUVD-2026-33569

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

CVE-2019-2844

Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite subcomponent: LDAP Client Tools. The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to...

CVE-2025-61912 python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination

python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, ldap.dn.escapednchars escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to...

EUVD-2019-9034

Malware in sbrugna...

EUVD-2019-12483

Malware in sbrugna...

EUVD-2023-29450

Malicious code in bioql PyPI...

CVE-2019-19413

There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerability by sending malformed packets to the target devices. Successful exploit could cause the affected system crash...

CVE-2002-2328

Active Directory in Windows 2000, when supporting Kerberos V authentication and GSSAPI, allows remote attackers to cause a denial of service hang via an LDAP client that sets the page length to zero during a large request...

CVE-2005-3170

The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer LDAPS even when the Certificate Authority CA is not trusted, which could allow attackers to trick users into believing that they are accessing a trusted site...

Do Not Install the LDAP Client

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. Running the LDAP service requires additional system resources and expands the attack surface. Therefore, do not install the LDAP client in the service...