5326 matches found
Default configuration
The default configuration of Oracle OpenSolaris snv77 through snv131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain...
CVE-2010-0559
The CVE-2010-0559 entry concerns Oracle OpenSolaris SNV releases snv_91 through snv_131. The vulnerability arises from the default configuration, allowing an attacker to achieve an unspecified impact via vectors related to using kclient to join a Windows Active Directory domain. The connected doc...
CVE-2010-0558
The default configuration of Oracle OpenSolaris snv77 through snv131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain...
CVE-2010-0559
The default configuration of Oracle OpenSolaris snv91 through snv131 allows attackers to have an unspecified impact via vectors related to using kclient to join a Windows Active Directory domain...
CVE-2010-0558
The CVE-2010-0558 entry concerns Oracle OpenSolaris in the SNV 77–131 series with a default configuration that allows an attacker to achieve an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain. Affected product/versions: Oracle OpenSolaris SNV build...
CVE-2010-0559: Undefined Security Weakness
The default configuration of Oracle OpenSolaris snv91 through snv131 allows attackers to have an unspecified impact via vectors related to using kclient to join a Windows Active Directory domain...
CVE-2010-0558: Undefined Security Weakness
The default configuration of Oracle OpenSolaris snv77 through snv131 allows attackers to have an unspecified impact via vectors related to using smbadm to join a Windows Active Directory domain...
citrix-brute-xml NSE Script
Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory. This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold...
Microsoft Windows ADFS服务单次登录功能认证欺骗漏洞（MS09-070）
BUGTRAQ ID: 37215 CVE ID: CVE-2009-2508 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的ADFS服务没有充分地验证会话管理，如果攻击者能够访问目标用户近期所使用的用于访问提供单次登录站点的工作站和Web浏览器，就可能允许攻击者扮演为通过认证的用户。 攻击者必须可以访问终端上之前用户所使用的认证令牌才可以利用这个漏洞。在启用了HTTPS服务器的情况下，认证令牌在传输中是受保护的，攻击者必须能够访问受害者的计算机（如自助终端机）才可以利用这个漏洞。在自助终端机上，用户可能登录到ADFS SSO...
Design/Logic Flaw
The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...
Remote code execution
Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...
CVE-2009-2509
Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...
CVE-2009-2508
CVE-2009-2508 affects Microsoft Windows ADFS SSO: the single sign-on implementation does not properly discard credentials at end of a session, enabling physically proximate attackers to impersonate a previous user by reusing browser-cache data. Affected are Windows Server 2003 SP2 and Windows Ser...
CVE-2009-2509
In CVE-2009-2509, Active Directory Federation Services (ADFS) on Windows Server 2003 SP2 and Windows Server 2008 SP2/Gold exposes remote code execution due to incorrect validation of HTTP request headers by an authenticated user. A crafted HTTP request to an ADFS-enabled IIS web server can execut...
CVE-2009-2508
The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...
CVE-2009-2509
Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...
Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution (971726)
Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution 971726 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...
CVE-2009-2509: Improper Input Validation
Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...
CVE-2009-2508: Undefined Security Weakness
The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...