Microsoft Azure Active Directory Login Enumeration

This module enumerates valid usernames and passwords against a Microsoft Azure Active Directory domain by utilizing a flaw in how SSO authenticates. Module Options msf use auxiliary/scanner/http/azureadlogin msf auxiliaryazureadlogin show actions ...actions... msf auxiliaryazureadlogin set ACTION...

DRUPAL-CONTRIB-2021-044

This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This...

Azure Active Directory Information Disclosure Vulnerability

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal which is not recommended. This vulnerability allows a user or service in the...

Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs

Microsoft recently mitigated an information disclosure issue, CVE-2021-42306, to prevent private key data from being stored by some Azure services in the keyCredentialsproperty of an Azure Active Directory Azure AD Applicationand/or Service Principal, and prevent reading of private key data...

アプリケーションおよびサービス プリンシパル API での Azure Active Directory (AD) keyCredential プロパティの情報漏えいに関するガイダンス

本ブログは、“Guidance for Azure Active Directory AD keyCredential property Information Disclosure in Application and Service Principal APIs” の抄訳版です。最新の情報は、原本...

CVE-2021-42306

creationtimestamp| type| source ---|---|--- 2021-11-17 07:00:00+00:00| seen| https://msrc.microsoft.com/blog/2021/11/guidance-for-azure-active-directory-ad-keycredential-property-information-disclosure-in-application-and-service-principal-apis/ 2021-11-18 13:13:22+00:00| published-proof-of-concep...

KLA12348 OSI vulnerability in Microsoft Azure

An information disclosure vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2021-42306 Related products Microsoft-Active-Directory Microsoft-Azure CVE list CVE-2021-42306 unknown Solution Install...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:3674-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3674-1 advisory. - An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the...

PT-2021-4858 · Microsoft · Azure Site Recovery +3

Name of the Vulnerable Software and Affected Versions: Azure Active Directory AAD affected versions not specified Azure Automation affected versions not specified Azure Site Recovery affected versions not specified Azure Migrate affected versions not specified Description: The issue is related to...

Microsoft Azure Active Directory Connect（ADC） 信息泄露漏洞

Microsoft Azure is an open, enterprise-class cloud computing platform from Microsoft Corporation USA. Microsoft Azure has a security vulnerability. No details of the vulnerability are currently available...

The importance of identity and Microsoft Azure Active Directory resilience

I love hearing my colleagues explain how they came to the industry because so many of their stories are unusual. I’m surprised how often I hear that people got into computer science by some fortuitous accident. Although he loved computers from the time he was a kid, Oren Melzer never expected to...

The vulnerability of the Active Directory Federation Services (ADFS) service on Microsoft Windows operating systems, which allows attackers to perform spear-phishing attacks

The vulnerability of the Active Directory Federation Services ADFS for Microsoft Windows operating systems is related to information representation errors at the user interface level. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:3662-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3662-1 advisory. - Windows Active Directory AD domains have by default a feature to allow users to create computer accounts, controlled by ms-DS-MachineAccountQuota...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:1471-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1471-1 advisory. - An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the...

Total Domain Compromise

Total domain compromise is possible in samba:edge . Due to a flaw found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication, the Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos P...

Zoho ManageEngine ADAudit Plus Arbitrary File Write Vulnerability

Zoho ManageEngine ADAudit Plus is a web-based Active Directory change auditing and reporting solution. An arbitrary file write vulnerability exists in Zoho ManageEngine ADAudit Plus versions prior to 7006, which can be exploited by an attacker to write and execute arbitrary files on the system...

Samba permission permission and access control issue vulnerability (CNVD-2022-15501)

Samba is the standard Windows interoperability suite for Linux and Unix. Samba is vulnerable to a permission permission and access control issue, which stems from a flaw found in the way samba can support RODCs read-only domain controllers as Active Directory domain controllers. An attacker could...

Samba Security Bypass Vulnerability (CNVD-2022-15500)

Samba is the standard Windows interoperability suite for Linux and Unix. A security vulnerability exists in Samba that stems from a flaw discovered in the way Samba, which acts as an Active Directory domain controller, implements Kerberos name-based authentication. An attacker could exploit this...

Microsoft Windows Active Directory Elevation of Privilege Vulnerability

Microsoft Windows Active Directory is a centralized directory management service from Microsoft Corporation USA that is responsible for architecting large network environments. Microsoft Windows Active Directory has an elevation of privilege vulnerability that could be exploited by an attacker to...

Ubuntu 20.04 LTS : Samba vulnerabilities (USN-5142-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5142-1 advisory. Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker could possibly use this issue to downgrade...