Design/Logic Flaw

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection...

CVE-2023-28853 Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform LDAP injection...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect Cloud Pak System (CVE-2022-34165, CVE2021-39031)

Summary Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect Cloud Pak System . Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Applicatio...

How to Avoid LDAP Injection Attacks

Discover how to implement preventative measures to avoid dangerous LDAP injection vulnerabilities...

CVE-2023-25613

A flaw was found in the kerby-backend. This issue leads to LDAP Injection...

Apache Kerby LDAP Injection Vulnerability

Apache Kerby is a Java Kerberos binding from the Apache Foundation, USA. Provides rich, intuitive, and interoperable implementations, libraries, KDCs, and facilities to integrate PKI, OTP, and tokens OAuth2 as needed for modern environments such as cloud, Hadoop, and mobile. An LDAP injection...

GHSA-337F-XR2X-6FCF Apache Kerby LdapIdentityBackend LDAP Injection vulnerability

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3...

Apache Kerby LdapIdentityBackend LDAP Injection vulnerability

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3...

CVE-2023-25613

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3...

Design/Logic Flaw

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3...

CVE-2023-25613

CVE-2023-25613 is an LDAP injection in Apache Kerby via LdapIdentityBackend. IBM/Cloudera advisories list CVE-2023-25613 among vulnerabilities affecting CDP (e.g., 7.1.9 HF2) and IBM DataStage on Cloud Pak for Data. Remediation provided: upgrade to Cloud Pak for Data 5.0.0+ for DataStage on Cloud...

SUSE CVE-2012-3981

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt...

Apache Druid JNDI Injection RCE

This module is designed to exploit the JNDI injection vulnerability in Druid. The vulnerability specifically affects the indexer/v1/sampler interface of Druid, enabling an attacker to execute arbitrary commands on the targeted server. The vulnerability is found in Apache Kafka clients versions...

LDAP Injection

sssd is vulnerable to LDAP Injection. The vulnerability exists because the libssscertmap fails to sanitize certificate data used in LDAP filters...

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

Design/Logic Flaw

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

PT-2023-16291 · Tenable · Tenable.Sc

Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A LDAP injection issue exists due to improper validation of user-supplied input. An authenticated attacker could generate data in Active Directory using the application account through...

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

CVE-2023-0476

CVE-2023-0476 is an LDAP injection vulnerability in Tenable.sc caused by improper validation of user input. An authenticated attacker could use the application account to generate data in Active Directory via blind LDAP injection. Affected product is Tenable.sc (vulnerable at least before 6.0.0)....

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...