4688 matches found
Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure
Description The plugin stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. PoC This requires the plugin's Log Authentication Requests setting to be...
GLSA-202309-06 : Samba: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202309-06 Samba: Multiple Vulnerabilities - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a...
ADCSKiller - An ADCS Exploitation Automation Tool Weaponizing Certipy And Coercer
ADCSKiller is a Python-based tool designed to automate the process of discovering and exploiting Active Directory Certificate Services ADCS vulnerabilities. It leverages features of Certipy and Coercer to simplify the process of attacking ADCS infrastructure. Please note that the ADCSKiller is...
Description of the security update for SharePoint Server Subscription Edition: September 12, 2023 (KB5002474)
None None...
PT-2023-6231 · Samba +10 · Samba +10
Name of the Vulnerable Software and Affected Versions: Samba affected versions not specified Description: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This issue stems from an RPC function that can be...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
Authentication flaw
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
CVE-2023-38743
Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine...
ZOHO ManageEngine ADManager Plus Security Vulnerability
ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...
TheHive Authorization Issues Vulnerability
TheHive is a scalable open source security incident response platform. A security vulnerability exists in StrangeBee TheHive that stems from a vulnerability that allows an attacker to gain privileges through the Active Directory authentication mechanism. Affected products and versions: StrangeBee...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
CVE-2023-39069
The CVE-2023-39069 entry affects StrangeBee TheHive and Cortex components: TheHive versions 4.1.21–5.0.8 and Cortex 3.1.6. The issue enables a remote attacker to gain privileges via the Active Directory authentication mechanism. All sources describe a privilege escalation through AD auth, but no ...
PT-2023-26772 · Strangebee · Thehive
Name of the Vulnerable Software and Affected Versions: StrangeBee TheHive versions 4.1.21 through 5.0.8 Cortex version 3.1.6 Description: An issue in the software allows a remote attacker to gain privileges via the Active Directory authentication mechanism. Recommendations: For StrangeBee TheHive...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
CVE-2023-39069
An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privileges via Active Directory authentication mechanism...
WordPress Staff / Employee Business Directory for Active Directory Plugin < 1.2.3 is vulnerable to Broken Access Control
Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4757 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 41d386a4513c...
Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
Description The plugin does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. Add a...
Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
Description The plugin does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. PoC Add ...
ManageEngine ADManager Plus < Build 7201 TFA Bypass
Zoho ManageEngine ADManager Plus before version 7.2 Build 7201 is affected by a two factor authentication bypass vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...