IBM AIX 'getpwnam()'本地权限提升漏洞(CVE-2012-0745)

BUGTRAQ ID: 53393 CVE ID: CVE-2012-0745 AIX是一个基于开放标准的UNIX操作系统，为用户提供企业信息技术基础架构。 IBM AIX 5.3、6.1、7.1在实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞获取提升的权限。 0 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 厂商补丁： IBM --- IBM已经为此发布了一个安全公告（ldapauthadvisory2）以及相应补丁: ldapauthadvisory2：Vulnerability in LDAP Authentication...

Owncloud 3.0.3 Clear Text Password Storage

Owncloud App "Ldap user backend" stored password in clear text Author: francesco.tornieri "At" verona-wireless.net Summary: store domain admin password in clear text Discovery date: 09/05/2012 Developer date contact : 09/05/2012 Where: From local Release Date: 11/05/2012 Criticality level: High...

CVE-2012-0745

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

Design/Logic Flaw

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

CVE-2012-0745

The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors...

LDAP Passwords Logged in Clear Text

An issue exists whereby LDAP bind passwords are logged to authd.log in clear text when using the default logging level of 'debug'. Ref 35493 This issue results in administrator passwords being logged and stored in clear text. Inappropriate access to this information can lead to unauthorized...

CVE-2012-0743

IBM Tivoli Directory Server TDS 6.3 and earlier allows remote attackers to cause a denial of service daemon crash via a malformed LDAP paged search request...

Cross site request forgery (csrf)

IBM Tivoli Directory Server TDS 6.3 and earlier allows remote attackers to cause a denial of service daemon crash via a malformed LDAP paged search request...

CVE-2012-0743

CVE-2012-0743 affects IBM Tivoli Directory Server (ITDS/TDS) versions 6.3 and earlier. A crafted LDAP paged search request can crash the daemon, causing denial of service. IBM’s advisory notes the vulnerability is a crash/vector that does not indicate arbitrary code execution. Remediation provide...

CVE-2012-0743

IBM Tivoli Directory Server TDS 6.3 and earlier allows remote attackers to cause a denial of service daemon crash via a malformed LDAP paged search request...

IBM Tivoli Directory Server < 6.1.0.47 / 6.2.0.22 / 6.3.0.11 Multiple Vulnerabilities (credentialed check)

According to its version, the installation of IBM Tivoli Directory Server on the remote host is prior to 6.1.0.47 / 6.2.0.22 / 6.3.0.11. It is, therefore, affected by one or more of the following vulnerabilities : - A custom LDAP client can be created which causes IBM Tivoli Directory Server to...

Dolibarr ERPCRM 3.2.0 3.1.1 - OS Command Injection

Dolibarr ERPCRM 3.2.0 3.1.1 - OS Command Injection Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Dolibarr ERP & CRM OS Command Injection

Exploit for php platform in category web applications Dolibarr ERP & CRM OS Command Injection =================================== 1. Advisory Information Date published: 2012-4-6 Vendors contacted: Dolibarr Release mode: Coordinated release 2. Vulnerability Information Class: Injection Remotely...

Fedora Update for phpldapadmin FEDORA-2011-14924

Check for the Version of phpldapadmin OpenVAS Vulnerability Test Fedora Update for phpldapadmin FEDORA-2011-14924 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for phpldapadmin FEDORA-2012-1253

Check for the Version of phpldapadmin OpenVAS Vulnerability Test Fedora Update for phpldapadmin FEDORA-2012-1253 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for curl FEDORA-2012-0894

Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2012-0894 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

JON: LDAP authentication allows any user access if bind credentials are bad

Red Hat JBoss Operations Network JON 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request...

Important: Red Hat Security Advisory: JBoss Operations Network 2.4.2 security update

An update for JBoss Operations Network 2.4.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

JON: LDAP authentication allows any user access if bind credentials are bad

Red Hat JBoss Operations Network JON 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request...

LDAP Account Manager Pro 3.6 跨站脚本和HTML注入漏洞

LDAP Account Manager LAM是一个基于浏览器的LDAP帐号管理系统 LDAP Account Manager LAM存在多个持久型输入校验漏洞，允许攻击者在应用程序段实现恶意脚本代码，成功利用漏洞操作数据或劫持会话user/mod/admin 另外也受客户端跨站脚本漏洞，允许攻击者劫持目标用户/admin会话 0 LDAP Account Manager Pro 3.6 厂商解决方案 目前没有详细解决方案提供： http://lam.sourceforge.net/index.htm...