ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

CVE-2023-0812 Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure...

CVE-2023-0812

CVE-2023-0812 affects the WordPress plugin Active Directory Integration / LDAP Integration (pre-4.1.1). The issue is unauthenticated data disclosure due to improper authorization or nonce handling on certain POST requests. A fix exists in version 4.1.1; affected users should upgrade to 4.1.1 or l...

WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.4 is vulnerable to SQL Injection

Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2484 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 166c0938a64d Credits Marco Wotschka...

WordPress plugin Active Directory Integration / LDAP Integration 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. An information disclosure vulnerability exists in the...

pki-core security, bug fix, and enhancement update

jss 5.3.0-1 - Rebase to JSS 5.3.0 5.3.0-0.3.beta2 - Rebase to JSS 5.3.0-beta2 - Bug 2017098 - pki pkcs12-cert-add command failing with 'Unable to validate PKCS 12 file: Digests do not match' exception 5.3.0-0.2.beta1 - Rebase to JSS 5.3.0-beta1 ldapjdk 5.3.0-1 - Rebase to LDAP SDK 5.3.0...

bind security and bug fix update

32:9.16.23-11 - Correct backport issue in statistics rendering fix 2126912 32:9.16.23-10 - Handle subtle difference between upstream and rhel CVE-2022-3094 32:9.16.23-9 - Prevent flooding with UPDATE requests CVE-2022-3094 - Handle RRSIG queries when server-stale is active CVE-2022-3736 - Fix cra...

WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.4 is vulnerable to SQL Injection

Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2599 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID adebea5f18df Credits Marco Wotschka...

AlmaLinux 9 : krb5 (ALSA-2023:2570)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2570 advisory. - Kerberos Security Feature Bypass Vulnerability CVE-2020-17049 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SUSE SLED15: antlr3-bootstrap-tool / antlr3-java / antlr3-java-javadoc / etc (SUSE-SU-2023:2097-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2097-1 advisory. maven: - Version update from 3.8.5 to 3.8.6 jscSLE-23217: Security fixes: - CVE-2021-42550: Update Versio...

Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2023-1879)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-28283

Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

CVE-2023-28283 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

CVE-2023-28283

CVE-2023-28283 is a Windows LDAP remote code execution vulnerability. Connected sources describe an unauthenticated RCE in the Windows LDAP service triggered by specially crafted LDAP requests, with the issue classified as high/critical in May 2023 updates. Root cause and exact impact are not dee...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

KB5026426: Windows Server 2008 R2 Security Update (May 2023)

The remote Windows host is missing security update 5026426. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

KB5026368: Windows 11 version 21H2 Security Update (May 2023)

The remote Windows host is missing security update 5026368. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

KB5026427: Windows Server 2008 Security Update (May 2023)

The remote Windows host is missing security update 5026427. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...