Adobe ColdFusion 11 Remote Code Execution Vulnerability

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html Version: Adobe...

Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Date: 2022-22-02 Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html...

Adobe ColdFusion 11 Remote Code Execution

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Date: 2022-22-02 Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html...

CVE-2022-0564

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

Authentication flaw

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

Security Bulletin: Security vulnerability in WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2021-39031)

Summary IBM WebSphere Application Server Liberty is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. WebSphere Application Server Liberty is vulnerable to LDAP Injection. Vulnerability Details Refer to the security bulletins listed in the...

PT-2022-13264 · Qlik · Qlik Sense Enterprise

Name of the Vulnerable Software and Affected Versions: Qlik Sense Enterprise on Windows affected versions not specified Description: A vulnerability in Qlik Sense Enterprise on Windows could allow a remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by...

CVE-2022-0564 Qlik Sense Enterprise Domain User enumeration

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

CVE-2022-0564

CVE-2022-0564 affects Qlik Sense Enterprise on Windows. The vulnerability exists in the /internal_forms_authentication/ endpoint and enables an unauthenticated/remote attacker to enumerate domain user accounts by measuring response times, conditioned on LDAP being configured. Impact is informatio...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

l4srs Rust implementation of the Log 4 Shell log 4 j - CVE-20...

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JND...

Security Bulletin: WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to LDAP Injection (CVE-2021-39031)

Summary WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to LDAP Injection CVE-2021-39031 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

Access Restriction Bypass in go-ldap

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

Grafana Authentication Bypass

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. Specific Go Packages Affected github.com/grafana/grafana/pkg/api...

GHSA-RGJG-66CX-5X9M Grafana Authentication Bypass

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. Specific Go Packages Affected github.com/grafana/grafana/pkg/api...

GHSA-X27W-QXHG-343V Access Restriction Bypass in go-ldap

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality,...

GHSA-V83P-XWM9-V4G8 Injection in Apache Archiva

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users...

Injection in Apache Archiva

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users...

Improper Certificate Validation in Graylog

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...