10214 matches found
Active Record component in Ruby on Rails has a data-type injection vulnerability
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...
GHSA-VCGJ-J8C5-2H52 Jenkins Active Directory Plugin did not verify certificate of AD server
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...
Jenkins Active Directory Plugin did not verify certificate of AD server
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks...
Jenkins Active Directory Plugin Improper certificate validation with StartTLS
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
GHSA-2H95-4XW9-M68J Jenkins Active Directory Plugin Improper certificate validation with StartTLS
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
GHSA-F5CH-36RG-VFCC Cross-Site Request Forgery in Apache CXF Fediz
Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...
Cross-Site Request Forgery in Apache CXF Fediz
Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...
The vulnerability of the Kerberos KDC component of the Active Directory service for Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Kerberos KDC component of the Active Directory catalog service on Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
May 10, 2022—KB5013952 (OS Build 14393.5125) - EXPIRED
None None...
Hackers Deploy IceApple Exploitation Framework on Hacked MS Exchange Servers
Researchers have detailed a previously undocumented .NET-based post-exploitation framework called IceApple that has been deployed on Microsoft Exchange server instances to facilitate reconnaissance and data exfiltration. "Suspected to be the work of a state-nexus adversary, IceApple remains under...
Intel Q1’18 Intel® Active Management Technology 9.x/10.x/11.x Security Review Cumulative Update
Summary: In an effort to continuously improve the robustness of the Intel® Converged Security Management Engine Intel® CSME, Intel has performed a security review of its Intel® CSME with the objective of continuously enhancing firmware resilience. Description: In an effort to continuously improve...
2020.2 IPU – Intel® CSME, SPS, TXE, and AMT Advisory
Summary: Potential security vulnerabilities in Intel® Converged Security and Manageability Engine CSME, Server Platform Services SPS, Intel® Trusted Execution Engine TXE, Intel® Dynamic Application Loader DAL, Intel® Active Management Technology AMT, Intel® Standard Manageability ISM and Intel®...
CVE-2022-22975
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...
CVE-2022-22975
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name CN of their user entry on the LDAP or AD server to include special characters, which could be used ...
Intel Manageability Commander 输入验证错误漏洞
Intel Manageability Commander is a lightweight console from Intel Corporation USA. for connecting to and using Intel Active Management Technology Intel AMT features. An input validation error vulnerability exists in Intel Manageability Commander versions prior to 2.2, which stems from incorrect...
Microsoft Windows Active Directory Elevation of Privilege Vulnerability (CNVD-2022-36664)
Microsoft Windows Active Directory is a common Windows domain environment configuration that can be used to issue and manage certificates used in various applications.An elevation of privilege vulnerability exists in Microsoft Windows Active Directory, and no detailed vulnerability details are...
Microsoft Windows Multiple Vulnerabilities (KB5013963)
This host is missing an important security update according to Microsoft KB5013963 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
PT-2022-3916 · Unknown · Pinniped Supervisor
Name of the Vulnerable Software and Affected Versions: Pinniped Supervisor affected versions not specified Description: An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. The issue allows an attack where a malicious us...
