CVE-2023-29057

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...

CVE-2023-29057

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...

CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it ca...

Code injection

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

CVE-2021-43145

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

CVE-2021-43145

The CVE-2021-43145 entry concerns Zammad 5.0.1 vulnerable due to LDAP configuration issues that enable unauthorized access to existing user accounts. The connected records corroborate an LDAP‑related privilege problem, with CVSS v3.1 indicating a NETWORK attack vector, LOW complexity, and HIGH im...

PT-2022-11793

Name of the Vulnerable Software and Affected Versions Zammad version 5.0.1 Description The issue allows for unauthorized access with existing user accounts under certain LDAP configurations. Recommendations For Zammad version 5.0.1, update to a newer version that addresses the issue, as the curre...

CVE-2021-43145: Undefined Security Weakness

With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts...

ASUS BMC Firmware Buffer Overflow Vulnerability (CNVD-2021-39587)

ASUS BMC Firmware is a firmware from Asus China. A buffer overflow vulnerability exists in the ASUS BMC firmware Web management page, which originates from the LDAP configuration function not validating the length of a string entered by the user, and can be exploited by a remote attacker to...

PT-2021-17793

Name of the Vulnerable Software and Affected Versions: ASUS BMC firmware affected versions not specified Description: The issue arises from the LDAP configuration function in the firmware's Web management page, which fails to verify the string length entered by users. This oversight leads to a...

CVE-2021-28177: Buffer Copy without Checking Size of Input

The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

ASUS BMC Firmware Security Feature Vulnerability

ASUS BMC Firmware is a firmware from Asus China. A buffer overflow vulnerability exists in the ASUS BMC firmware Web management page, which originates from the LDAP configuration function not validating the length of a string entered by the user, and can be exploited by a remote attacker to...

CVE-2020-5246: Improper Neutralization of Special Elements used in an LDAP Query

Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances wit...

CVE-2019-5648

Authenticated, administrative access to a Barracuda Load Balancer ADC running unpatched firmware = v6.4 allows one to edit the LDAP service configuration of the balancer and change the LDAP server to an attacker-controlled system, without having to re-enter LDAP credentials. These steps can be us...

CVE-2020-6202

SAP NetWeaver Application Server Java User Management Engine, versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation...

SUSE SLED15 / SLES15 Security Update : amavisd-new (SUSE-SU-2019:0505-1)

This update for amavisd-new fixes the following issues : wmavisd-new was updated to version 2.11.1 bsc1123389 : removed a trailing dot element from @INC, as a workaround for a perl vulnerability CVE-2016-1238 bsc987887 amavis-services: bumping up syslog level from LOGNOTICE to LOGERR for a messag...

CVE-2016-10512

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

Code injection

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2016-10512: Undefined Security Weakness

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2016-10512

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...