SysAid Server - Arbitrary File Disclosure

Vantage Point Security Advisory 2014-004 ======================================== Title: SysAid Server Arbitrary File Disclosure ID: VP-2014-004 Vendor: SysAid Affected Product: SysAid On-Premise Affected Versions: Summary: --- SysAid Server is vulnerable to an unauthenticated file disclosure...

Windows Gather Active Directory Users

This module will enumerate user accounts in the default Active Domain AD directory and stores them in the database. If GROUPMEMBER is set to the DN of a group, this will list the members of that group by performing a recursive/nested search i.e. it will list users who are members of groups that a...

Login bypass when using user_ldap due to unauthenticated binds - ownCloud

"userldap" in the web-interface called "LDAP user and group backend" is an optional authentication backend for ownCloud for using LDAP users and groups within the ownCloud web application. The ownCloud team has discovered a vulnerability within the "userldap" application which, depending on the...

Server: Login bypass when using user_ldap due to unauthenticated binds

"userldap" in the web-interface called "LDAP user and group backend" is an optional authentication backend for ownCloud for using LDAP users and groups within the ownCloud web application. The ownCloud team has discovered a vulnerability within the "userldap" application which, depending on the...

Windows Active Directory Wordlist Builder

This module will gather information from the default Active Domain AD directory and use these words to seed a wordlist. By default it enumerates user accounts to build the wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

The Windows Kerberos vulnerability details becoming clearer-vulnerability warning-the black bar safety net

The day before yesterday, Microsoft's unconventional update fixes a particularly serious defect: any login to the domain where the users can be their own elevated privileges to other users privileges, even including the domain administrator privileges. The author from the pre-notification informe...

Microsoft Active Directory Federation Services information leakage

It's possible to access closed session...

openSUSE Security Update : sssd (openSUSE-SU-2014:1407-1)

sssd was updated to new upstream release 1.12.2 bugfix release, bnc900159 Changes : - Fixed a regression where the IPA provider did not fetch User Private Groups correctly - An important bug in the GPO access control which resulted in a wrong principal being used, was fixed. - Several new options...

MS14-077: Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3003381)

The remote Windows host is affected by a vulnerability in the Active Directory Federation Services AD FS that allows an attacker to obtain unspecified information if a user logs off the application without closing their browser and an attacker immediately reopens the application. C Tenable Networ...

CentOS 5 : sudo (CESA-2013:1353)

An updated sudo package that fixes multiple security issues and several bugs is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (3003381)

This host is missing an important security update according to Microsoft Bulletin MS14-077. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2014-6331

Microsoft Active Directory Federation Services AD FS 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active...

Information disclosure

Microsoft Active Directory Federation Services AD FS 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active...

CVE-2014-6331

Microsoft Active Directory Federation Services AD FS 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active...

CVE-2014-6331

CVE-2014-6331 affects Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1 and 3.0. The vulnerability arises when a configured SAML Relying Party lacks a sign-out endpoint and logoff actions are not processed correctly, enabling information disclosure and potential access via an unatte...

November 2014 Updates

Today, as part of Update Tuesday, we released 14 security updates – four rated Critical, nine rated Important, and two rated Moderate, to address 33 Common Vulnerabilities and Exposures CVEs in Microsoft Windows, Internet Explorer IE, Office, .NET Framework, Internet Information Services IIS,...

KLA10612 Information disclosure vulnerability in Microsoft AD Federation Services

An unspecified vulnerability was found in Microsoft AD Federation Services. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via unattended workstation manipulations. Original advisories CVE-2014-6331 Related products...

MS14-077: Vulnerability in Active Directory Federation Services could allow information disclosure: November 11, 2014

None None...

Microsoft Active Directory Federation Services CVE-2014-6331 Information Disclosure Vulnerability

Description Microsoft Active Directory Federation Services is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. Technologies Affected Microsoft Active Directory Federation Services 2.0...

Advance Notification Service for the November 2014 Security Bulletin Release

Today, we provide advance notification for the release of 16 Security Bulletins. Five of these updates are rated Critical, nine are rated as Important, and two are rated Moderate in severity. These updates are for Microsoft Windows, Internet Explorer, Office, Exchange, .NET Framework, Internet...