4416 matches found
The vulnerability of the `ksmbd_vfs_stream_read()` function in the KSMBD daemon of the Linux operating system allows a hacker to disclose protected information and cause service failures.
The vulnerability of the ksmbdvfsstreamread function in the KSMBD daemon of the Linux operating system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information and cause service failures by...
PT-2025-1874
Name of the Vulnerable Software and Affected Versions Xerox VersaLink Printers affected versions not specified Xerox VersaLink C7025 MFPs affected versions not specified Description The issue allows authentication to be redirected to another server when accessing LDAP settings, potentially exposi...
[SECURITY] Fedora 40 Update: freeipa-4.12.2-3.fc40
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
[SECURITY] Fedora 41 Update: freeipa-4.12.2-7.fc41
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...
GHSA-M3HP-8546-5QMR Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without...
Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without...
CVE-2025-0604
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
CVE-2025-0604
CVE-2025-0604 is a Keycloak authentication bypass vulnerability where, after an AD password reset, Keycloak updates credentials without performing an LDAP bind to validate them against AD. This can allow access for accounts that are expired or disabled, bypassing AD restrictions. Public details i...
CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
CVE-2025-0604
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
Keycloak 授权问题漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an authorization issue vulnerability that stems from a failure to validate a new password during a password reset, which allows an expired or disabled AD user to bypass restrictions...
The vulnerability of the Active Directory Federation Server component for the Windows operating system, which allows a attacker to perform a CSRF attack
The vulnerability of the Active Directory Federation Server operating system on Windows is related to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to execute a CSRF attack remotely...
Researchers Warn of NTLMv1 Bypass in Active Directory Policy
Silverfort has discovered that a misconfiguration can bypass an Active Directory Group Policy designed to disable NTLMv1, allowing…...
Microsoft Active Directory Domain Services Elevation of Privilege Vulnerability (CNVD-2025-02127)
Microsoft Active Directory Domain Services is a key service from Microsoft Corporation USA for managing and organizing resources, users, computers, and other security objects in a network. A security vulnerability exists in Microsoft Active Directory Domain Services. An attacker could exploit the...
Researchers Find Exploit Allowing NTLMv1 Despite Active Directory Restrictions
Cybersecurity researchers have found that the Microsoft Active Directory Group Policy that's designed to disable NT LAN Manager NTLM v1 can be trivially bypassed by a misconfiguration. "A simple misconfiguration in on-premise applications can override the Group Policy, effectively negating the...
The vulnerability of the Active Directory Domain Services service on the Windows operating system allows a perpetrator to elevate their privileges to a system-level level.
The vulnerability of the Active Directory Domain Services service on the Windows operating system is related to access control errors. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to a system-level level...
PT-2025-3854 · Splunk · Splunk Supporting Add-On For Active Directory
Name of the Vulnerable Software and Affected Versions: Splunk Supporting Add-on for Active Directory versions 3.1.0 and earlier Description: A vulnerable regular expression pattern in the Splunk Supporting Add-on for Active Directory could lead to a Regular Expression Denial of Service ReDoS...