4416 matches found
Information disclosure
An information disclosure vulnerability exists in Azure Active Directory AAD Microsoft Account MSA during the login request session, aka 'Windows Information Disclosure Vulnerability'...
CVE-2019-1258
CVE-2019-1258 concerns the Azure Active Directory Authentication Library (ADAL) On-Behalf-Of flow, where token caching can let an authenticated attacker operate in another user’s context. The vulnerability is described across multiple sources (Microsoft MSRC advisory and related advisories) as an...
CVE-2019-1258 Azure Active Directory Authentication Library Elevation of Privilege Vulnerability
...
Azure Active Directory Authentication Library Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This vulnerability allows an authenticated attacker to perform actions in context of another user. The authenticated attacker can exploit this...
Microsoft Azure Active Directory Authentication Library Elevation of Privilege Vulnerability
Microsoft Azure Active Directory Authentication Library is an authentication library from Microsoft Corporation USA. This product allows client applications to authenticate users. An elevation of privilege vulnerability exists in On-Behalf-Of flow in the Azure Active Directory Authentication...
Microsoft Guidance for Enabling LDAP Channel Binding and LDAP Signing
Executive Summary LDAP channel binding and LDAP signing provide ways to increase the security for communications between LDAP clients and Active Directory domain controllers. A set of unsafe default configurations for LDAP channel binding and LDAP signing exist on Active Directory domain...
Windows Information Disclosure Vulnerability
An information disclosure vulnerability exists in Azure Active Directory AAD Microsoft Account MSA during the login request session. An attacker who successfully exploited the vulnerability could take over a user's account. To exploit the vulnerability, an attacker would have to trick a user into...
PT-2019-3054 · Microsoft · Azure Active Directory Authentication Library
Name of the Vulnerable Software and Affected Versions: Azure Active Directory Authentication Library affected versions not specified Description: The issue is related to insecure privilege management in the Azure Active Directory Authentication Library, specifically in the On-Behalf-Of flow, wher...
PT-2019-3007 · Microsoft · Azure Active Directory +1
Name of the Vulnerable Software and Affected Versions: Azure Active Directory AAD Microsoft Account MSA affected versions not specified Description: An information disclosure issue exists in Azure Active Directory AAD Microsoft Account MSA during the login request session, allowing an attacker to...
CVE-2019-14969
Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.ADA.StorageAuditService which writes to that directory does not perform proper impersonation, and thus the target file will have the same...
How to get the Organization Units (OU) and Hosts from Microsoft Active Directory using Python ldap3
I recently figured out how to work with Microsoft Active Directory using Python 3. I wanted to get a hierarchy of Organizational Units OUs and all the network hosts associated with these OUs to search for possible anomalies. If you are not familiar with AD, here is a good thread about the...
Commando VM v2.0 - The First Full Windows-based Penetration Testing Virtual Machine Distribution
Welcome to CommandoVM - a fully customizable, Windows-based security distribution for penetration testing and red teaming. For detailed install instructions or more information please see our blog Installation Install Script Requirements Windows 7 Service Pack 1 or Windows 10 60 GB Hard Drive 2 G...
Commando VM 2.0: Customization, Containers, and Kali, Oh My!
The Complete Mandiant Offensive Virtual Machine “Commando VM” swept the penetration testing community by storm when it debuted in early 2019 at Black Hat Asia Arsenal. Our 1.0 release made headway featuring more than 140 tools. Well now we are back again for another spectacular release, this time...
July 9, 2019—KB4507449 (Monthly Rollup)
None None...
July 9, 2019—KB4507448 (Monthly Rollup)
None None...
July 9, 2019—KB4507435 (OS Build 17134.885)
None None...
July 9, 2019—KB4507461 (Security-only update)
None None...
July 9, 2019—KB4507462 (Monthly Rollup)
None None...