391 matches found
PT-2025-47785
Name of the Vulnerable Software and Affected Versions Vault Terraform Provider versions prior to 5.5.0 Description The Vault Terraform Provider was configured with an insecure default setting for the LDAP auth method. Specifically, the deny null bind parameter defaulted to false, which could allo...
CVE-2025-62795
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted messages to the /ws/ldap/ WebSocket...
CVE-2024-13999
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...
CVE-2023-53690
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...
CVE-2023-53690
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...
PT-2025-44500
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3 Description Nagios XI, under certain circumstances, reveals the server's Active Directory AD or Lightweight Directory Access Protocol LDAP authentication token to a user who is already authenticated. This...
Nagios Network Analyzer 安全漏洞
Nagios Network Analyzer is an enterprise solution for monitoring and analyzing network traffic from Nagios, Inc. A security vulnerability exists in Nagios Network Analyzer versions prior to 2024R2.0.1, which stems from improper cleanup of inputs to the LDAP certificate management feature and coul...
AZL-68454 CVE-2025-61912 affecting package python-ldap 3.4.0-1
python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, ldap.dn.escapednchars escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to...
EUVD-2019-10155
Malware in sbrugna...
EUVD-2022-35354
Malicious code in bioql PyPI...
EUVD-2022-35349
Malicious code in bioql PyPI...
EUVD-2024-43803
Malicious code in bioql PyPI...
EUVD-2022-35369
Malicious code in bioql PyPI...
EUVD-2022-26048
Malicious code in bioql PyPI...
EUVD-2022-35406
Malicious code in bioql PyPI...
org.apache.cxf/cxf: CXF JMS Code Execution Vulnerability
A flaw was found in org.apache.cxf/cxf, where untrusted users can configure JMS to allow the specification of RMI or LDAP URLs, possibly leading to code execution. This vulnerability allows an attacker to provide malicious protocol URLs during JMS configuration...
Splunk Enterprise 9.2.0 < 9.2.8, 9.3.0 < 9.3.6, 9.4.0 < 9.4.4, 10.0.0 < 10.0.1 (SVD-2025-1005)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-1005 advisory. - In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108,...
WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WPMU Ldap Authentication versions = 5.0.1...
CVE-2025-48913
A flaw was found in org.apache.cxf/cxf, where untrusted users can configure JMS to allow the specification of RMI or LDAP URLs, possibly leading to code execution. This vulnerability allows an attacker to provide malicious protocol URLs during JMS configuration. Mitigation To reduce risk,...
HashiCorp Vault和HashiCorp Vault Enterprise 安全漏洞
HashiCorp Vault and HashiCorp Vault Enterprise are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault is a private key access management tool.HashiCorp Vault Enterprise is an enterprise information archiving platform. A security vulnerability exists in HashiCorp Vault and HashiCorp...