QNAP QTS < 4.2.4 Build 20170313 Multiple Vulnerabilities - Active Check

QNAP QTS web user interface is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

RedHat Update for curl RHSA-2017:0847-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Airwatch 6.1.x / 6.4.x LDAP Injection

https://www.osisecurity.com.au/airwatch-self-service-portal-username-parameter-ldap-injection.html Date: 04-Apr-2017 Product: AirWatch Self Service MDM Versions affected: v6.1.x v6.4.x Vulnerability: LDAP injection Example: https://target/DeviceManagement/ URL accepts the following POST parameter...

CVE-2016-8779

Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol LDAP operation command into a specific input variable to obtain sensitive information from the database...

Design/Logic Flaw

Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol LDAP operation command into a specific input variable to obtain sensitive information from the database...

CVE-2016-8779

CVE-2016-8779 affects Huawei FusionAccess (software versions V100R005C10 and V100R005C20). A lack of input validation allows remote attackers with specific permissions to inject LDAP operations into a particular input variable, enabling access to sensitive information from the database. The vulne...

CVE-2016-8779

Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol LDAP operation command into a specific input variable to obtain sensitive information from the database...

LDAP Injection

Lightweight Directory Access Protocol LDAP is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On SSO service that will allow clients to authenticate with a web site without any interaction assuming...

LLMNR NBT-NS MDNS Poisoner: Responder

LLMNR NBT-NS MDNS Poisoner: Responder Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. This tool is an LLMNR, NBT-NS and MDNS responder, it will...

QNAP QTS < 4.2.4 Build 20170313 Multiple Vulnerabilities - Version Check

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

Faraday v2.4 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

Privilege escalation

NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL...

CVE-2016-9167

NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL...

CVE-2016-9167

Affected product: Novell eDirectory NDSD prior to 9.0.2. The issue is that ACLs on LDAP objects across partition boundaries are not calculated correctly, enabling privilege escalation by modifying user attributes that would otherwise be filtered by an ACL. Root cause: incorrect ACL evaluation acr...

How does LDAP Authentication work with Kerberos Impersonation SSO?

How does LDAP Authentication work with Single Sign On using Kerberos Impersonation? In this flow, the NetScaler is contacting the KDC after we purged tickets on the KDC, and the NetScaler. 1. The client makes a GET request to the LB vServer. 2. The LB vServer is configured with Form-based...

LDAP SSL - invalid user account-LdapErr-DSID-0C090FB4-Error-initializing-SSL

ISSUE: User can not login after changing LDAP authentication to LDAP SSL authentication. Error message: Invalid user account. Symptom: Check the Network Trace and found. For TLS: 22283 2017-03-09 16:54:29.344825357 2.2.2.22.2.2.3LDAP 232 extendedResp1 00000000: LdapErr: DSID-0C090FB4, comment:...

Change of Expired LDAP Password on NetScaler During Log On Fails Intermittently

Changing the expired LDAP password at the time of user login via NetScaler Gateway due to password-expiry may fail and demonstrate itself on the login page as: "Incorrect credentials. Try again." or "Cannot connect. Try connecting again." ifEnhanced Authentication Feedback is enabled: At the time...

Invalid Authentication And Information Disclosure

dropwizard-auth-ldap is vulnerable to information disclosure. When TLS negotiation is not successful due to a failure in the certificate validation, the authenticate method on the LDAP server logs an error could not negotiate TLS. However, it also proceeds to pass the user credentials as plain te...

OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743)

It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN...

USN-3198-1: OpenJDK 6 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...