CVE-2011-2014

The CVE-2011-2014 entry concerns LDAPS in Active Directory, ADAM, and AD LDS where the LDAPS implementation does not check Certificate Revocation Lists (CRLs). Affected products include Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2/R2/R2 SP1, and Windows ...

MS11-086: Description of the security update for Active Directory: November 8, 2011

None None...

MS11-086: Vulnerability in Active Directory Could Allow Elevation of Privilege (2630837)

The remote Windows host has a version of Active Directory that fails to validate the revocation status of an SSL certificate against the CRL Certificate Revocation List associated with the domain account. When Active Directory is configured to use LDAP over SSL, a remote attacker can exploit this...

MS11-086: Vulnerability in Active Directory could allow elevation of privilege: November 8, 2011

Resolves a vulnerability in Active Directory that could allow elevation of privilege.INTRODUCTIONMicrosoft has released security bulletin MS11-086. To view the complete security bulletin, visit one of the following Microsoft websites: Home...

Microsoft Active Directory LDAPS Authentication Bypass Vulnerability

Description Microsoft Active Directory is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions by using a revoked certificate. Technologies Affected Avaya Aura Conferencing 6.0 Standard Avaya CallPilot 4.0 Avaya CallPilot 5.0...

PT-2011-3552 · Microsoft · Windows Xp +7

Name of the Vulnerable Software and Affected Versions: Active Directory versions prior to the fixed version Active Directory Application Mode ADAM versions prior to the fixed version Active Directory Lightweight Directory Service AD LDS versions prior to the fixed version Microsoft Windows XP...

IT-Grundschutz M4.315: Aufrechterhaltung der Betriebssicherheit von Active Directory

IT-Grundschutz M4.315: Aufrechterhaltung der Betriebssicherheit von Active Directory. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94233 Diese Prüfung bezieht sich a...

IT-Grundschutz M4.315: Aufrechterhaltung der Betriebssicherheit von Active Directory

IT-Grundschutz M4.315: Aufrechterhaltung der Betriebssicherheit von Active Directory. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94233 Diese Prüfung bezieht sich a...

krb5-enum-users NSE Script

Discovers valid usernames by brute force querying likely usernames against a Kerberos service. When an invalid username is requested the server will respond using the Kerberos error code KRB5KDCERRCPRINCIPALUNKNOWN, allowing us to determine that the user name was invalid. Valid user names will...

GateOne Beta - Terminal emulator for HTML5 web browsers

GateOne Beta - Terminal emulator for HTML5 web browsers The software makes use of WebSockets to connect a server backend written in Python and a frontend written for modern browsers in JavaScript, HTML5 and CSS. The frontend doesn't require any browser plug-ins to be installed.Gate One also...

Member servers are not able to authenticate to the Domain Controller

Challenge Either of the following errors occur: No authority could be contacted for authentication. Copy The trust relationship between this workstation and the primary domain failed. Copy Cause The server has lost trust with the Active Directory domain. Solution Login to the machine using a loca...

Preemptive Protection against Microsoft Active Directory Certificate Services Cross-Site Scripting (MS11-051; CVE-2011-1264)

A cross-site scripting vulnerability has been reported in Microsoft Active Directory Certificate Services...

Windows Gather Enumerate Domain

This module identifies the primary Active Directory domain name and domain controller. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Enumerate Domain', 'Description' = %q This...

Windows Gather AutoLogin User Credential Extractor

This module extracts the plain-text Windows user login password in Registry. It exploits a Windows feature that Windows 2000 to 2008 R2 allows a user or third-party Windows Utility tools to configure User AutoLogin via plain-text password insertion in AltDefaultPassword field in the registry...

CVE-2011-1264

Cross-site scripting XSS vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory...

Cross site scripting

Cross-site scripting XSS vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory...

CVE-2011-1264

Active Directory Certificate Services Web Enrollment (AD CS Web Enrollment) on Microsoft Windows Server 2003 SP2 and Windows Server 2008 Gold, SP2, R2, and R2 SP1 is affected by CVE-2011-1264. The vulnerability is a cross-site scripting (XSS) flaw in the Web Enrollment interface that allows remot...

CVE-2011-1264

Cross-site scripting XSS vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory...

Microsoft Certificate Services crossite scripting

Crossite scripting in Active Directory Certificate Services Web Enrollment...

Active Directory Certificate Services Web Enrollment Anonymous Access

The remote web server is running the Microsoft Certificate Services. However, the service is misconfigured in such a way that anonymous users can log into the service to request certificates, thus breaking the chain of trust. C Tenable Network Security, Inc. include"compat.inc"; if description...