10230 matches found
UBUNTU-CVE-2022-0336
The Samba AD DC includes checks when adding service principals names SPNs to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as...
activechristianity.org Open Redirect vulnerability OBB-2348676
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Apache Struts 2.5.x Multiple Log4j Vulnerabilities (Log4Shell) - Active Check
Apache Struts is prone to multiple vulnerabilities in the Apache Log4j library. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
VeridiumAd 环境问题漏洞
VeridiumAd is an enterprise-ready solution from Veridium UK. that adds biometric authentication and identity assurance to Microsoft Active Directory environments. A security vulnerability exists in VeridiumAd 2.5.3.0, which arises from an HTTP request that triggers a push notification for a...
BloodyAD - An Active Directory Privilege Escalation Framework
BloodyAD is an Active Directory Privilege Escalation Framework, it can be used manually using bloodyAD.py or automatically by combining pathgen.py and autobloody.py. This framework supports NTLM with password or NTLM hashes and Kerberos authentication and binds to LDAP/LDAPS/SAMR services of a...
anyone can call forceRemoveByActiveBalance()
Handle Tomio Vulnerability details Impact A user can call forceRemoveByActiveBalance and this function didn’t verify if the caller is equal to the protocol agent, that eventually clear the remaining balance. Proof of Concept --- The text was updated successfully, but these errors were encountered...
Owner can set arbitrary premium which allow nonStakers drain funds
Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...
SolarWinds Serv-U vulnerability exploited to deliver Log4j attack
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. SolarWinds is affected by a vulnerability CVE-2021-35247 due to improper input validation when processing LDAP queries in the Serv-U web login screen. Serv-U versions up to 15.2.5 are affected by this flaw and were fixed in...
A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.
...
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords including administrative users and privileged service accounts (eg Domain Controllers).
...
How to configure SSO for Citrix Cloud administrators using Azure AD or Okta
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information...
ZOHO ManageEngine Log360 has an unspecified vulnerability
ZOHO ManageEngine Log360 is an integrated log management and Active Directory auditing and alerting solution from ZOHO USA. The solution helps you mitigate security threats, detect persistent attack attempts, detect suspicious user activity and comply with regulatory? A security vulnerability...
Jenkins Active Directory Plugin Information Disclosure Vulnerability
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . An information disclosure vulnerability exists in Jenkins Active Directory Plugin version 2.25 and earlier, which stems...
Raven - Advanced Cyber Threat Map (Simplified, Customizable, Responsive)
Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Live - Demo https://qeeqbox.github.io/raven/ Offline - Demo Features Uses D3.js Not...
Citrix PVS soap server service does not start and crashes after installing Microsoft January 2022 Updates (E.g. KB5008877 or KB5009546)
Since installing Microsoft January 2022 Updates like KB5009546 or KB5008877 the Citrix PVS soap server service doesn't start anymore. When trying to start this service it crashes right away. While this happens the Citrix PVS API service also stops working. Soapserver.exe crashes Event 1000 .net...
GHSA-C8CC-HJ57-VM65 User passwords transmitted in plain text by Jenkins Active Directory Plugin
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...
User passwords transmitted in plain text by Jenkins Active Directory Plugin
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations...
RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.9] Async #2 (Important) (RHSA-2022:0133)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0133 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-nod...
RHEL 8 : samba (RHSA-2022:0074)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0074 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...
