GitHub Security Lab: [Python] CWE-287: LDAP Improper Authentication

This bug was reported directly to GitHub Security Lab...

Exploit for CVE-2021-2394

CVE-2021-2394 POC for CVE-2021-2394 - Disclaimer - This pr...

GitLab: Improper access control for users with expired password, giving the user full access through API and Git

Summary Users with an "expired password" can still access the full API with tokens. This includes the REST API, GraphQL API and Git HTTP access. The same issue was mitigated in 13.12.2 as "Insufficient Expired Password Validation". That patch blocked users with expired passwords from accessing th...

Audit Logs Store LDAP Password in Plain Text

h3. Problem In Confluence, when an external LDAP directory is created/modified, Audit logs store the LDAP connection password as plain text. h3. Environment 7.4.x . h3. Steps to Reproduce 1. In Confluence, create or modify a directory as Microsoft Active Directory, Crowd, Jira etc 2. After...

Audit Logs Store LDAP Password in Plain Text

h3. Problem In Confluence, when an external LDAP directory is created/modified, Audit logs store the LDAP connection password as plain text. h3. Environment 7.4.x . h3. Steps to Reproduce 1. In Confluence, create or modify a directory as Microsoft Active Directory, Crowd, Jira etc 2. After...

How to Change Password for LDAP Authentication for NetScaler Gateway and AAA-TM Users

This article provides information on how LDAP password change can be achieved for NetScaler Gateway and AAA-TM users. Prerequisite NetScaler 10.1.x onwards...

U.S. Dept Of Defense: [CVE-2021-29156] LDAP Injection at https://██████

Description: https://█████ is vulnerable to CVE-2021-29156 References https://hackerone.com/reports/1278050 https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...

How to use Secure LDAP to Change the User Password in NetScaler Gateway

This article provides information on how to use Lightweight Directory Access Protocol LDAP in NetScaler Gateway to change the users passwords. However, Secure LDAP is required to change the password. Note : Windows Server global catalog port 3268 or secure global catalog port 3269 do not support...

U.S. Dept Of Defense: [CVE-2021-29156 on ForgeRock OpenAm] LDAP Injection in Webfinger Protocol!

Description: https://████████ is vulnerable to CVE-2021-29156. References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...

RHEL 7 : libldb (RHSA-2021:2786)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2786 advisory. The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. Securit...

Important: Red Hat Security Advisory: libldb security update

An update for libldb is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support, Red Hat Enterprise Linux 7.6 Telco Extended Update Support, and Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impac...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-2229)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libldb (EulerOS-SA-2021-2222)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : samba (EulerOS-SA-2021-2229)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading ...

EulerOS 2.0 SP5 : libldb (EulerOS-SA-2021-2222)

According to the versions of the libldb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading...

Security Bulletin: IBM Data Replication Management Console Authentication Affected by Annonymous Binding (CVE-2020-4821)

Summary This bulletin covers a vulnerability found in the Management Console client under which authentication may be by-passed if configured to authenticate against LDAP directories allowing anonymous binding. Vulnerability Details CVEID: CVE-2020-4821 DESCRIPTION: IBM Cognos Controller, under...

Security Bulletin: IBM Data Replication Management Console Authentication By-pass against LDAP directories using anonymous binding

Summary This bulletin covers a vulnerability found in the Management Console client under which authentication may be by-passed if configured to authenticate against LDAP directories allowing anonymous binding. Vulnerability Details CVEID: CVE-2020-4821 DESCRIPTION: IBM Cognos Controller, under...

LDAP service is down after upgrading to 13.0 build 82, 12.1 build 62

LDAP LB Vservice configured with User monitor script nsldap.pl showing down after upgrading to13.0 build 82 /12.1 build 62. User authentication fails...

Huawei EulerOS: Security Advisory for cyrus-sasl (EulerOS-SA-2021-2081)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-2079)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...