4417 matches found
ldap_fluff authentication bypass
The ldapfluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors...
Jenkins Active Directory Plugin did not verify certificate of AD server
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...
GHSA-VCGJ-J8C5-2H52 Jenkins Active Directory Plugin did not verify certificate of AD server
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...
Jenkins Active Directory Plugin Improper certificate validation with StartTLS
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
GHSA-2H95-4XW9-M68J Jenkins Active Directory Plugin Improper certificate validation with StartTLS
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
The vulnerability of the Kerberos KDC component of the Active Directory service for Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Kerberos KDC component of the Active Directory catalog service on Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
May 10, 2022—KB5013952 (OS Build 14393.5125) - EXPIRED
None None...
Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers
Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration. "Suspected to be the work of a state-nexus adversary, IceApple remains under...
CVE-2022-22975
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...
CVE-2022-22975
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...
Microsoft Windows Multiple Vulnerabilities (KB5013963)
This host is missing an important security update according to Microsoft KB5013963 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Microsoft Windows Active Directory Elevation of Privilege Vulnerability (CNVD-2022-36664)
Microsoft Windows Active Directory is a common Windows domain environment configuration that can be used to issue and manage certificates used in various applications.An elevation of privilege vulnerability exists in Microsoft Windows Active Directory, and no detailed vulnerability details are...
PT-2022-3916 · Unknown · Pinniped Supervisor
Name of the Vulnerable Software and Affected Versions: Pinniped Supervisor affected versions not specified Description: An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. The issue allows an attack where a malicious us...
CVE-2022-26923
Active Directory Domain Services Elevation of Privilege Vulnerability...
CVE-2022-26923
Active Directory Domain Services Elevation of Privilege Vulnerability...
Privilege escalation
Active Directory Domain Services Elevation of Privilege Vulnerability...
CVE-2022-26923
CVE-2022-26923 affects Microsoft Active Directory Domain Services with AD CS involvement. The vulnerability stems from certificates issued by AD CS where an attacker who manages computer accounts can modify the dNSHostName attribute to impersonate a Domain Controller in a certificate, enabling pr...
CVE-2022-26923 Active Directory Domain Services Elevation of Privilege Vulnerability
...
