PT-2015-7012

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.x through 3.7.5 Cybozu Garoon versions 4.x through 4.0.3 Description The issue concerns the mishandling of authentication requests, allowing remote authenticated users to conduct LDAP injection attacks. This can lead t...

CVE-2015-5649: Improper Authentication

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration...

JVN#38369032: Cybozu Garoon vulnerable to LDAP injection

Cybozu Garoon is a groupware. Cybozu Garoon contains an issue in processing authentication requests, which may result in an LDAP injection vulnerability. Impact A malicious user authorized to administer uesrs in certain groups may obtain information from the authentication server or may perform a...

UBUNTU-CVE-2015-2704

realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response...

CVE-2015-1169

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

Authentication flaw

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

CVE-2015-1169

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

CVE-2015-1169

The CVE-2015-1169 entry relates to Apereo CAS Server prior to 3.5.3, where LDAP injection is possible through a crafted username, demonstrated by using wildcards to bypass LDAP authentication. A remote attacker could potentially authenticate without valid credentials by exploiting a wildcard user...

CVE-2015-1169: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...

CVE-2014-5114

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

Code injection

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

CVE-2014-5114

WeBid <= 1.1.1 is vulnerable to LDAP injection via the (1) js and (2) cat parameters, allowing remote attackers to exploit the issue (CVE-2014-5114). Multiple sources (NVD, Red Hat advisory, CVE listings, and OpenVAS) confirm this vulnerability in WeBid 1.1.1, with a CVSSv2 base score of 7.5 (...

CVE-2014-5114

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

CVE-2014-5114: Undefined Security Weakness

WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the 1 js or 2 cat parameter...

WeBid <= 1.1.1 Multiple XSS and LDAP Injection Vulnerabilities

WeBid is prone to multiple cross-site scripting XSS and LDAP injection vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WeBid - Multiple Cross-Site Scripting LDAP Injection Vulnerabilities

WeBid - Multiple Cross-Site Scripting LDAP Injection Vulnerabilities source: https://www.securityfocus.com/bid/68519/info WeBid is prone to multiple cross-site-scripting vulnerabilities and an LDAP injection vulnerability. An attacker may leverage these issues to compromise the application, acces...

WeBid 1.1.1 Cross Site Scripting / LDAP Injection

Exploit Title : WeBid Version 1.1.1 multiple vulnerability Author : Govind Singh aka NullPort Vendor : http://www.webidsupport.com/ Download Link : http://sourceforge.net/projects/simpleauction/files/simpleauction/WeBid%20v1.1.1/WeBid-1.1.1.zip/download Google Dork : "Powered by WeBid" Date :...

WeBid - Multiple Cross-Site Scripting / LDAP Injection Vulnerabilities

source: https://www.securityfocus.com/bid/68519/info WeBid is prone to multiple cross-site-scripting vulnerabilities and an LDAP injection vulnerability. An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

LDAP injection - ownCloud

Due to not properly sanitizing the LDAP queries an attacker is able to: Gain information about existing LDAP users Modify the login query, e.g. with a wildcard Affected Software ownCloud Server 6.0.2 CVE-2014-2047 ownCloud Server 5.0.15 CVE-2014-2049 Action Taken All LDAP queries have been review...

Server: LDAP injection

Due to not properly sanitizing the LDAP queries an attacker is able to: Gain information about existing LDAP users Modify the login query, e.g. with a wildcard For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...