CVE-2007-2999

Microsoft Windows Server 2003, when time restrictions are in effect for user accounts, generates different error messages for failed login attempts with a valid user name than for those with an invalid user name, which allows context-dependent attackers to determine valid Active Directory account...

CVE-2007-2999

CVE-2007-2999 affects Microsoft Windows Server 2003 where time-restricted user accounts produce different error messages for failed logins with valid usernames versus invalid usernames. This behavior enables context-dependent attackers to enumerate valid Active Directory account names. The vulner...

Microsoft活动目录登录用户名枚举漏洞

Microsoft Active Directory是一款目录服务，可以实现整个网络的集中式安全管理。。 Microsoft Active Directory存在一个设计缺陷，远程攻击者可以利用漏洞枚举用户名信息。 如果通过Windows终端服务提供合法的用户名，根据域控制器返回的错误消息不同，可导致获得用户名是否存在信息。不过此漏洞只存在于用户帐户被设置了时间限制和这些帐户只有在这些时间里访问才存在。 Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard...

Microsoft Windows Active Directory users account enumeration

It's possible to enumerate accounts with Logon Hours limitation set...

[Full-disclosure] Microsoft Windows Active Directory Logon Hours User Enumeration Weakness

Windows Server 2003 can be configured http://support.microsoft.com/kb/816666 to restrict the hours and days that a user may log on to a Windows Server 2003 domain. This could lead to username enumeration. Issue:- Microsoft Windows Active Directory Username Enumeration Criticality:- Less Critical...

Authorization

KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...

CVE-2007-2849

KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...

CVE-2007-2849

KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...

CVE-2007-2849

KnowledgeTree Document Management aka KnowledgeTree Open Source before STABLE 3.3.7 does not require a password for an unregistered user, when the user exists in Active Directory, which allows remote attackers to log onto KTDMS without the intended authorization check...

CVE-2007-2849

The CVE-2007-2849 entry affects KnowledgeTree Document Management (KnowledgeTree Open Source) prior to STABLE 3.3.7. The vulnerability allows an unregistered user to log in if the user exists in Active Directory, bypassing the intended authorization check and enabling remote login to KTDMS. Affec...

CVE-2007-2476

Unspecified vulnerability in Novell SecureLogin NSL 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory AD password changes...

Design/Logic Flaw

Unspecified vulnerability in Novell SecureLogin NSL 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory AD password changes...

CVE-2007-2476

Unspecified vulnerability in Novell SecureLogin NSL 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active Directory AD password changes...

CVE-2007-2476

CVE-2007-2476 is associated with Novell SecureLogin (NSL) versions prior to 6.0.106 (NSL 6 SP1 and earlier). The connected Nessus data confirms multiple issues, including a vulnerability that could grant users excessive permissions to their own AD attributes and an additional security issue relat...

Novell SecureLogin < 6.0.106 Multiple Vulnerabilities

The version of Novell SecureLogin installed on the remote host is earlier than 6.0.106. Such versions reportedly grant a user excessive permissions to their own attributes in an Active Directory AD environment. There is also a security issue with AD password change. Note that Novell strongly...

Microsoft DNS Server (Dynamic DNS Updates) Remote Exploit

No description provided by source. / Exploiting Microsoft DNS Dynamic Updates for Fun and profit Andres Tarasco Acu?a - c 2007 Url: http://www.514.es By default, most Microsoft DNS servers integrated with active directory allow insecure dynamic updates for dns records. This feature allows remote...

Authentication flaw

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...

CVE-2007-0433

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...

CVE-2007-0433

BEA AquaLogic Enterprise Security 2.0–2.0 SP2, 2.1–2.1 SP1, and 2.2 using Active Directory LDAP for authentication is vulnerable: remote authenticated users can access the server even after the account is disabled. Root cause/technical specifics beyond this description are not provided in the sup...

CVE-2007-0433

Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled...