4416 matches found
CVE-2023-4505
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative...
Input validation
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access an...
Input validation
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative...
Zoho ManageEngine ADManager Plus Authorization Issues Vulnerability
ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...
CVE-2023-4506
CVE-2023-4506 affects the WordPress plugin Active Directory Integration / LDAP Integration (ldap-login-for-intranet-sites). The vulnerability arises from insufficient validation when changing the LDAP server, allowing authenticated users with administrative privileges to switch the LDAP server an...
CVE-2023-4505
The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative...
CVE-2023-4506 Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access an...
Active Directory Integration / LDAP Integration < 4.2 - Admin LDAP Passback
Description The plugin does not properly validate input when changing the LDAP server. This can result in the ability for authenticated administrators to alter the LDAP server and access the credentials of the original LDAP server...
WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.11 is vulnerable to Broken Access Control
Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4506 Patch priority Low CVSS severity Low 2.2 Developer Claim ownership PSID 98c5dc7e14ed Credits...
WordPress Staff / Employee Business Directory for Active Directory Plugin <= 1.2.3 is vulnerable to Broken Access Control
Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4505 Patch priority Low CVSS severity Low 2.2 Developer Claim ownership PSID 98e206a92bda...
Staff / Employee Business Directory for Active Directory < 1.3 - Admin LDAP Credentials Retrieval
Description The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with...
Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure
Description The plugin stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. PoC This requires the plugin's Log Authentication Requests setting to be...
GLSA-202309-06 : Samba: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202309-06 Samba: Multiple Vulnerabilities - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a...
ADCSKiller - An ADCS Exploitation Automation Tool Weaponizing Certipy And Coercer
ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services ADCS vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure. Please note that the ADCSKiller is...
Description of the security update for SharePoint Server Subscription Edition: September 12, 2023 (KB5002474)
None None...
PT-2023-6231 · Samba +10 · Samba +10
Name of the Vulnerable Software and Affected Versions: Samba affected versions not specified Description: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This issue stems from an RPC function that can be...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
