Moderate: Red Hat Security Advisory: 389-ds:1.4 security and bug fix update

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openldap bug fix and enhancement update

OpenLDAP is an open-source suite of Lightweight Directory Access Protocol LDAP applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, an...

LibrIT PaSSHport LDAP Injection Unauthorized Access

The vulnerability of the LibrIT PaSSHport solution for secure SSH access exists due to the lack of measures to neutralize special elements in the LDAP request LDAP integration. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information by sendin...

CVE-2021-20574

IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and takeover other accounts. IBM X-Force ID: 199252...

Stormshield Network Security 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in Stormshield Network Security that can be exploited by an attacker to bypass data access restrictions via LDAP User Enumeration to obtain...

Vulnerability fixed in OpenAM

A vulnerability has been fixed in OpenAM. The vulnerability allows an unauthenticated remote malicious person to use of an LDAP injection attack to obtain sensitive information. Updates have been released to fix the vulnerability. More information can be found on the page below:...

CVE-2021-29156

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key...

CVE-2020-36144

Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the search filter lacks sanitization...

Samba LDAP Library Data Compromise

The vulnerability of the LDAP library in the Samba networking software package is related to security flaws. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

CVE-2021-21484

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind...

activemq: LDAP authentication bypass with anonymous bind

A flaw was found in activemq. When anonymous binds are enabled on the LDAP provider zero length DN/password and the LDAP module is configured to make use of these, client credentials are not correctly verified and authentication is effectively bypassed. The highest threat from this vulnerability ...

OpenLDAP Double Release Vulnerability (CNVD-2021-07318)

OpenLDAP is a free, open source implementation of the Lightweight Directory Access Protocol LDAP. A double release vulnerability exists in OpenLDAP versions prior to 2.4.57. An attacker could exploit this vulnerability to cause a slapd crash in saslAuthzTo processing...

Exploit for Improper Privilege Management in Microsoft

内网渗透学习笔记 作者：chriskali Github：chriskaliX 近期，拜读了腾讯蓝军-红蓝对抗之Windows内网渗透，学到了不少知识点。打算拆分章节进行整理以及复现，主要记录自己缺失的知识点。这是一个大杂烩文章，主线是跟着jumbo师傅的思路，碰到感兴趣的，我会继续扩展。可能有点凌乱，希望大家见谅。 0x01 环境搭建 这一步略过，简单介绍一下测试的环境 |主机名|IP地址|角色|系统| |:-:|:-:|:-:|:-:| |DC|10.10.10.10|DC|DNS|Winserver 2012| |John|10.10.10.11|normal|win7|...

DEBIAN-CVE-2020-25275

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts...

parse-server 加密问题漏洞

parse-server is an open source Backend-as-a-Service BaaS framework , it is mainly used for application back-end processing . A security vulnerability exists in Parse Server versions prior to 4.5.0 that stems from LDAP authentication involving user passwords stored in plaintext. No details of the...

HashiCorp Vault Information Disclosure Vulnerability

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. An information disclosure vulnerability exists in HashiCorp Vault Enterprise version 1.4.1 of Sentinel EGP, which stems from allowing users to be enumerated via the LDAP authentication method...

389-ds:1.4 bug fix update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Bug Fixes: Entries conflict not resolved by replication BZ1904347 Duplicate entryUSN numbers for...

CVE-2020-15376

Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implementation that could allow a remote ldap user to login in the Brocade Fibre Channel SAN switch with "user" privileges if it is not associated with any groups...

MySQL Server LDAP Auth DoS

The vulnerability of the Server component’s Security: LDAP Auth module of the MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

USN-4634-2: OpenLDAP vulnerabilities

USN-4634-1 fixed several vulnerabilities in OpenLDAP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that OpenLDAP incorrectly handled certain malformed inputs. A remote attacker could possibly use this issue t...