756 matches found
GHSA-26CM-QRC6-MFGJ Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker
Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. Patches Patch for vulnerability released with v1.16.3. Workarounds Disable LDAP feature if in use References OWASP LDAP Injection Prevention Cheat Sheet For more information If you have any questions or...
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker
Impact LDAP injection vulnerability, only affects instances with LDAP authentication enabled. Patches Patch for vulnerability released with v1.16.3. Workarounds Disable LDAP feature if in use References OWASP LDAP Injection Prevention Cheat Sheet For more information If you have any questions or...
LDAP Injection
github.com/stevenweathers/thunderdome-planning-poker is vulnerable to LDAP injection. Lack of an escape filter allows remote attackers to inject specially crafted values through UserName parameter resulting in LDAP injection vulnerability. Successful attackers are able to read, modify or delete...
OpenAM 13.0 - LDAP Injection Exploit
Exploit Title: OpenAM 13.0 - LDAP Injection Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...
OpenAM 13.0 - LDAP Injection
Exploit Title: OpenAM 13.0 - LDAP Injection Date: 03/11/2021 Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...
CVE-2021-41232
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...
CVE-2021-41232
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...
Code injection
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...
CVE-2021-41232 Improper Neutralization of Special Elements used in an LDAP Query
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...
CVE-2021-41232
Summary: Thunderdome is affected by an LDAP injection vulnerability in the LDAP authentication path due to improper escaping of the supplied username. The flaw impacts affected versions prior to patch release 1.16.3 and has been addressed in 1.16.3. If upgrading is not feasible, disable LDAP auth...
CVE-2021-37933
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...
CVE-2021-37933
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...
Authentication flaw
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...
CVE-2021-37933
The CVE-2021-37933 entry pertains to Huntflow Enterprise; an LDAP injection in /account/login could let an unauthenticated remote attacker bypass authentication by manipulating the email parameter used to build LDAP queries. Affected versions are prior to 3.10.6. Root cause: insufficient server-s...
CVE-2021-37933
An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...
ForgeRock OpenAM LDAP Injection
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol or the password reset feature. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key. No source data...
A1:Injection — Top 10 OWASP 2017
A1:Injection — Top 10 OWASP 2017 💉 Introduction Injection is an issue that arises quite often and in several forms, things like SQL databases for example might contain issues such as SQL injection and the same might go for things like LDAP, XML, OS commands,… . In other words, there is a range of...
rConfig <= 3.9.6 Multiple Vulnerabilities
rConfig is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...