GHSA-FM5C-2RWC-887W Cloud Foundry UAA reset password vulnerable to brute force attack

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple...

Apache Directory Studio Command Injection

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet...

GHSA-P9QJ-4RJP-J3W9 Apache Directory Studio Command Injection

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet...

GHSA-FJ69-P8F6-Q97H Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions prior to 2.2.5 and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable onl...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72858)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP remote code execution vulnerability

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72857)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72853)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72854)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72855)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Incorrect Permission Assignment for Critical Resource

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72856)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Microsoft Windows LDAP Remote Code Execution Vulnerability (CNVD-2022-72859)

Microsoft Windows is a desktop operating system from Microsoft Corporation. Microsoft Windows LDAP is vulnerable to remote code execution, which can be exploited by attackers to execute code on the target host...

Security Bulletin: IBM Security Verify Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20488, CVE-2021-20494, CVE-2021-20572, CVE-2021-20573, CVE-2021-20574)

Summary IBM has announced a release for IBM Security Verify Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern denial of service and account take over. Vulnerability Details CVEID:CVE-2021-20572 DESCRIPTION: IBM Security Identi...

Moderate: Red Hat Security Advisory: redhat-ds:11 security and bug fix update

Red Hat Directory Server 11.5 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2022-22975

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...

Design/Logic Flaw

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...

Security Bulletin: IBM MQ WebConsole and REST API are affected by CVE-2021-39031.

Summary An issue was identified within the IBM WebSphere Application Server Liberty profile that IBM MQ uses to provide web console and REST API functionality. Vulnerability Details CVEID:CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow ...

CVE-2022-22975

CVE-2022-22975 affects VMware Pinniped Pinniped Supervisor components that handle LDAPIdentityProvider or ActiveDirectoryIdentityProvider. The root cause is unvalidated LDAP/AD query construction when a malicious user alters the CN to contain special characters, enabling LDAP query injection in t...

CVE-2022-22975

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...