VeridiumAd 环境问题漏洞

VeridiumAd is an enterprise-ready solution from Veridium UK. that adds biometric authentication and identity assurance to Microsoft Active Directory environments. A security vulnerability exists in VeridiumAd 2.5.3.0, which arises from an HTTP request that triggers a push notification for a...

BloodyAD - An Active Directory Privilege Escalation Framework

BloodyAD is an Active Directory Privilege Escalation Framework, it can be used manually using bloodyAD.py or automatically by combining pathgen.py and autobloody.py. This framework supports NTLM with password or NTLM hashes and Kerberos authentication and binds to LDAP/LDAPS/SAMR services of a...

SolarWinds Serv-U vulnerability exploited to deliver Log4j attack

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. SolarWinds is affected by a vulnerability CVE-2021-35247 due to improper input validation when processing LDAP queries in the Serv-U web login screen. Serv-U versions up to 15.2.5 are affected by this flaw and were fixed in...

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords including administrative users and privileged service accounts (eg Domain Controllers).

...

How to configure SSO for Citrix Cloud administrators using Azure AD or Okta

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information...

ZOHO ManageEngine Log360 has an unspecified vulnerability

ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity and comply with regulatory? A security vulnerability...

Jenkins Active Directory Plugin Information Disclosure Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . An information disclosure vulnerability exists in Jenkins Active Directory Plugin version 2.25 and earlier, which stems...

Citrix PVS soap server service does not start and crashes after installing Microsoft January 2022 Updates (E.g. KB5008877 or KB5009546)

Since installing Microsoft January 2022 Updates like KB5009546 or KB5008877 the Citrix PVS soap server service doesn't start anymore. When trying to start this service it crashes right away. While this happens the Citrix PVS API service also stops working. Soapserver.exe crashes Event 1000 .net...

GHSA-C8CC-HJ57-VM65 User passwords transmitted in plain text by Jenkins Active Directory Plugin

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

User passwords transmitted in plain text by Jenkins Active Directory Plugin

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

RHEL 8 : samba (RHSA-2022:0074)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0074 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...

RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.9] Async #2 (Important) (RHSA-2022:0133)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0133 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-nod...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

Code injection

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

CVE-2022-23105

CVE-2022-23105 affects Jenkins Active Directory Plugin 2.25 and earlier. The vulnerability stems from the plugin not encrypting data transmitted between the Jenkins controller and Active Directory servers in most configurations, enabling potential information disclosure. Connected advisories refe...

CVE-2022-23105

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...

[updated] You can update now: Microsoft patches 97 bugs including 6 zero-days and a wormable one

How time flies sometimes. Microsoft yesterday released the first patch Tuesday security updates of the year 2022. The update includes fixes for six zero-day vulnerabilities and a total of 97 bugs. This includes two Remote Code Execution RCE vulnerabilities affecting open source libraries. None of...

samba: Active Directory (AD) domain user could become root on domain members

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation...