Metasploit Wrap-Up 07/11/2025

Active Directory LDAP Library This week Metasploit added a library for working with Active Directory Domain Controllers over LDAP. The library consolidates common functionality and implements a caching mechanism to support common operations such as looking up objects by their DN, sAMAccountName, ...

Metasploit Weekly Wrap-Up 06/17/2025

New Modules & Adapters, and Improvements! This week’s release brings new modules, additional adapter payloads and improvements to existing modules and features. These modules target software such as ThinManager, Remote for Mac, Roundcube and more. It also includes additional work from bcoles that...

com.nimbusds:common (>=1.73, <=1.74), com.nimbusds:oauth2-oidc-sdk (2.11) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.19)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:common =1.73, =1.74 - com.nimbusds:oauth2-oidc-sdk 2.11 - com.nimbusds:oidc-userinfo-ldap...

com.nimbusds:c2id-server-sdk (>=2.0, <=2.0.3), com.nimbusds:oauth2-oidc-sdk (>=4.0, <=4.3) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.1.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:c2id-server-sdk =2.0, =4.0, =1.2.10, =1.2.14 Source cves: CVE-2025-53864 Source advisory:...

com.nimbusds:oauth2-oidc-sdk (>=3.0.2, <=3.2), com.nimbusds:oidc-claims-source-ldap (>=1.2.4, <=1.2.5) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.25)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.25 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.0.2, =1.2.4, =1.2.4, =1.4-release, =1.4-release, =1.5.4-release Source...

com.nimbusds:oauth2-oidc-sdk (2.9), com.nimbusds:oidc-userinfo-ldap (1.1) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.18.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.9 - com.nimbusds:oidc-userinfo-ldap 1.1 - com.nimbusds:oidc-userinfo-sp...

com.nimbusds:oauth2-oidc-sdk (>=3.4, <=3.4.1), com.nimbusds:oidc-claims-source-ldap (>=1.2.7, <=1.2.9) +10 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.26.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =3.4, =1.2.7, =1.2.7, =1.1.9, =1.1.9, =1.1.9, =1.1.9, =1.7.0, =4.3.1,...

com.nimbusds:oauth2-oidc-sdk (3.0.1), com.nimbusds:oidc-claims-source-ldap (1.2.3) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.24)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.24 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 3.0.1 - com.nimbusds:oidc-claims-source-ldap 1.2.3 -...

com.nimbusds:oauth2-oidc-sdk (>=2.1, <=2.8), com.nimbusds:oidc-userinfo-ldap (1.0) +1 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.16)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.1, =2.8 - com.nimbusds:oidc-userinfo-ldap 1.0 -...

PT-2025-42838

Уязвимость сценария /app-settings/ldap/ajax системы управления службой поддержки FreeScout связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

SQL Injection

Overview z-push/z-push-dev is an open-source application to synchronize ActiveSync compatible devices Affected versions of this package are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field ...

SUSE CVE-2025-4573

Mattermost versions 10.7.x = 10.7.1, 10.6.x = 10.6.3, 10.5.x = 10.5.4, 9.11.x = 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT...

CVE-2025-34067

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an...

CVE-2025-6081

Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker...

ROS-20250703-01

Vulnerability in Server Mode LDAP authentication configuration of database management tool pgAdmin 4 is related to incorrect session commit as a result of improper access delimitation. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the security restrictions...

USN-7616-1: logback vulnerabilities

It was discovered that logback could read malicious configuration files from LDAP servers. An attacker with the required permissions could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2021-42550 It was...

CVE-2025-34067 Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an...

CVE-2025-34067

CVE-2025-34067 affects Hikvision Integrated Security Management Platform (applyCT component). The flaw is deserialization of untrusted input in /bic/ssoService/v1/applyCT via vulnerable Fastjson auto-type, enabling remote code execution by loading a malicious Java class referenced through an LDAP...

CVE-2025-34067: Deserialization of Untrusted Data

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an...

CVE-2025-6081

Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker...