756 matches found
CVE-2023-44038
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack...
CVE-2023-44038
CVE-2023-44038 affects VeridiumID prior to 3.5.0, where the identity provider page is vulnerable to an LDAP injection that allows an unauthenticated attacker to enumerate information about registered users. Affected product: VeridiumID (versions before 3.5.0). Root cause: LDAP injection on the id...
CVE-2023-44038
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack...
Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to remote attack due to Apache Derby (CVE-2022-46337)
Summary Apache Derby is shipped with IBM Tivoli Netcool Impact as part of its datastructure. Information about a security vulnerability affecting Apache Derby has been published in a security bulletin. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Bouncy Castle Crypto Package for Java
Summary Multiple vulnerabilities in Bouncy Castle Crypto Package for Java used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Java bc-java could allow a remote attacker to obtain sensitive...
bouncycastle: potential blind LDAP injection attack using a self-signed certificate
A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...
BIT-REDASH-2020-36144
Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization...
Security Bulletin: Apache Derby vulnerability addressed in IBM Business Automation Workflow on containers [CVE-2022-46337]
Summary IBM Business Automation Workflow on containers addessed CVE-2022-46337. A copy of derby is included on container images, but never used in a supported scenario. Even in unsupported scenarios, there is no way of letting derby interact with LDAP. Vulnerability Details CVEID:CVE-2022-46337...
Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management
Summary Multiple vulnerabilities were addressed in IBM Application Performance Management 8.1.4.0 IF15 patch Vulnerability Details CVEID:CVE-2022-44729 DESCRIPTION: Apache Batik is vulnerable to server-side request forgery, caused by improper input validation. By persuading a victim to open...
CVE-2022-2232
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions. Mitigation This flaw requires a misconfiguration of the "UUID LDAP Attribute" values. When they are set to the standard...
Security Bulletin: Vulnerability in Apache Derby affects IBM Cloud Pak System [CVE-2022-46337]
Summary Vulnerability in Apache Derby affects IBM Cloud Pak System CVE-2022-46337 This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: Apache Derby could allow a remote attacker to bypass security restrictions, caused by ...
CVE-2024-22319
CVE-2024-22319 affects IBM Operational Decision Manager; affected versions include 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1. Root cause is remote code execution via JNDI injection when an unchecked argument is passed to a specific API. IBM IBM X-Force ID: 279145. Remediation ...
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Apache Derby
Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Apache Derby. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2022-46337 DESCRIPTION: Apache Derby could allow a remote attacker to bypass...
CVE-2023-51446
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...
Design/Logic Flaw
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...
UBUNTU-CVE-2023-51446
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...
CVE-2023-51446 GLPI LDAP Injection during authentication
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...
CVE-2023-51446 GLPI LDAP Injection during authentication
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...
GLPI -- multiple vulnerabilities
GLPI team reports: GLPI 10.0.12 Changelog SECURITY - moderate Reflected XSS in reports pages CVE-2024-23645 SECURITY - moderate LDAP Injection during authentication CVE-2023-51446...
PT-2024-14128 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.12 Description: The issue is related to LDAP injection when authentication is made against a LDAP server. This can be exploited by a remote attacker to perform LDAP injection using the authentication form. The...