CVE-2026-103880

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103880 Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

EUVD-2026-91359

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103880

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced...

CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

EUVD-2026-91378

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

EUVD-2026-91382

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-103552

A Stack Overflow vulnerability exists in the Apache Directory LDAP API (versions 1.2.0 to before 1.2.9). An unauthenticated remote attacker can trigger this by submitting a deeply nested search filter before binding with the server. The flaw occurs in the server's decoder, which can lead to an ap...

CVE-2026-103552 Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-103552

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9,...

CVE-2026-102731

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

EUVD-2026-91333

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

powerview.py

Installation | Basic Usage | Obfuscation | Modules | Logging | User Defined Rules | MCP | Plugins | Acknowledgements Overview PowerView.py is an alternative for the awesome original PowerView.ps1 script. Most of the modules used in PowerView are available here some of the flags are changed . Main...

LDAPMon

LDAPMon LDAPMon is a POC telemetry collector for the Microsoft-Windows-LDAP-Client ETW Provider. Once started logs will be stored within the EventViewer. This POC comes with a Sentinel parser so that if you want to collect this data within a SIEM you may do so. Used best when ran next to Sysmon...

Cable

Cable Cable is a post-exploitation tool used for reconnaissance and Discretionary Access Control List DACL focused exploitation of an Active Directory environment. This tool was primarily created to learn more about .NET offensive development in an Active Directory context, while hoping to expand...

goddi

ARCHIVE NOTE Project is no longer actively maintained. goddi - Go dump domain info Based on work from Scott Sutherland @nullbind, Antti Rantasaari, Eric Gruber @egru, Will Schroeder @harmj0y, and the PowerView authors. Install Use the executables in the releases section. If you want to build it...

CVE-2026-21011-Log4j-style-JNDI-Injection-in-Custom-Logger-Simulated-

CVE-2026-21011 – Log4j‑style JNDI Injection in Custom Logger Simulated Program Code Java simulation in Python log4jsim.py - Custom logger that evaluates $... patterns import subprocess, re def logmessage: Vulnerable: looks up JNDI-like syntax and executes pattern = r'$\jndi:.+?' for match in...

homelab-CVE-2021-44228

Homelab: Log4Shell CVE-2021-44228 on Apache Solr Controlled Docker environment to reproduce and study the Log4Shell vulnerability in Apache Solr. The Environment Target solr-lab: Apache Solr v8.11.0 vulhub/solr:8.11.0 running a vulnerable version of Log4j. Attacker kali-lab: Basic Kali Linux...