SUSE-SU-2016:0224-1 Security update for openldap2

This update fixes the following security issues: - CVE-2015-6908: The bergetnext function allowed remote attackers to cause a denial of service reachable assertion and application crash via crafted BER data, as demonstrated by an attack against slapd. bsc945582 - CVE-2015-4000: Fix weak...

intranet.sensefly.com XSS vulnerability

Vulnerable URL: https://intranet.sensefly.com/intranet/change-ldap-password.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0 VIP websi...

Amazon Linux: Security Advisory (ALAS-2016-636)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 385-2] isc-dhcp regression update

Package : isc-dhcp Version : 4.1.1-P1-15+squeeze10 CVE ID : CVE-2015-8605 Debian Bug : 810875 With the previous upload of the isc-dhcp package to Debian Squeeze LTS two issues got introduced into LTS that are resolved by this upload. 1 CVE-2015-8605 had only been resolved for the LDAP variant of...

Amazon Linux AMI : realmd (ALAS-2016-636)

A flaw was found in the way realmd parsed certain input when writing configuration into the sssd.conf or smb.conf file. A remote attacker could use this flaw to inject arbitrary configurations into these files via a newline character in an LDAP response. C Tenable Network Security, Inc. The...

Amazon Linux AMI : libldb (ALAS-2016-633)

A denial of service flaw was found in the ldbwildcardcompare function of libldb. A remote attacker could send a specially crafted packet that, when processed by an application using libldb for example the AD LDAP server in Samba, would cause that application to consume an excessive amount of memo...

Medium: realmd

Issue Overview: A flaw was found in the way realmd parsed certain input when writing configuration into the sssd.conf or smb.conf file. A remote attacker could use this flaw to inject arbitrary configurations into these files via a newline character in an LDAP response. Affected Packages: realmd...

PowerDNS < 2.9.18 Multiple Vulnerabilities

According to its self-reported version number, the version of the PowerDNS service listening on the remote host is prior to 2.9.18. It is, therefore, affected by multiple vulnerabilities : - A flaw exists due to improper escaping of LDAP queries. A remote attacker can exploit this to cause a deni...

IBM Jazz Reporting Service Lifecycle Query Engine LDAP Injection Vulnerability

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in conjunction with IBM Rational CLM's Rational solution for managing all the lifecycles of a development project. CLM users can access JRS-provided reports from a dashboard th...

Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20160107)

A denial of service flaw was found in the LDAP server provided by the AD DC in the Samba process daemon. A remote attacker could exploit this flaw by sending a specially crafted packet, which could cause the server to consume an excessive amount of memory and crash. CVE-2015-7540 Multiple buffer...

Scientific Linux Security Update : samba on SL7.x x86_64 (20160107)

A denial of service flaw was found in the LDAP server provided by the AD DC in the Samba process daemon. A remote attacker could exploit this flaw by sending a specially crafted packet, which could cause the server to consume an excessive amount of memory and crash. CVE-2015-7540 Multiple buffer...

CVE-2015-7466

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

Design/Logic Flaw

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

CVE-2015-7466

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

CVE-2015-7466

The CVE-2015-7466 issue affects IBM Jazz Reporting Service (JRS) Lifecycle Query Engine (LQE) in the JRS 6.0 line (before 6.0.0-Rational-CLM-ifix005). The vulnerability enables LDAP injection by remote authenticated users, allowing bypass of query restrictions or modification of the LDAP director...

大汉网络 /jcms/interface/ldap/receive.jsp 接口未授权更改密钥

相关代码如下 if state.equals"S" //注册应用 boolean b = ldapBlf.writeXMLappname,enckey,ldapurl,webtype,ssourl,encrypttype; 未授权注册并覆盖了 enckey 得到 enckey 之后利用可以参照 https://www.sebug.net/vuldb/ssvid-90213...

Moderate: Red Hat Security Advisory: samba security update

Updated samba packages that fix multiple security issues are now available for Red Hat Gluster Storage 3.1 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

libldb: remote memory read in the Samba LDAP server

A memory-read flaw was found in the way the libldb library processed LDB DN records with a null byte. An authenticated, remote attacker could use this flaw to read heap-memory pages from the server...

libldb: Remote DoS in Samba (AD) LDAP server

A denial of service flaw was found in the ldbwildcardcompare function of libldb. A remote attacker could send a specially crafted packet that, when processed by an application using libldb for example the AD LDAP server in Samba, would cause that application to consume an excessive amount of memo...

libldb: remote memory read in the Samba LDAP server

A memory-read flaw was found in the way the libldb library processed LDB DN records with a null byte. An authenticated, remote attacker could use this flaw to read heap-memory pages from the server...