The vulnerability of the Active Directory service for Windows operating systems arises from the insecure management of privileges, allowing attackers to elevate their privileges within the system.

The vulnerability of the Active Directory service for Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to escalate privileges within the system remotely...

Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs

Microsoft recently mitigated an information disclosure issue, CVE-2021-42306, to prevent private key data from being stored by some Azure services in the keyCredentials property of an Azure Active Directory Azure AD Application and/or Service Principal, and prevent reading of private key data...

Microsoft Azure Active Directory Login Enumeration

This module enumerates valid usernames and passwords against a Microsoft Azure Active Directory domain by utilizing a flaw in how SSO authenticates. Module Options msf use auxiliary/scanner/http/azureadlogin msf auxiliaryazureadlogin show actions ...actions... msf auxiliaryazureadlogin set ACTION...

DRUPAL-CONTRIB-2021-044

This module enables users to authenticate through their Microsoft Azure AD account. The module does not sufficiently check authorization before updating user profile information in certain non-default configurations. This could lead a user being able to hijack another existing account. This...

Azure Active Directory Information Disclosure Vulnerability

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal which is not recommended. This vulnerability allows a user or service in the...

Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs

Microsoft recently mitigated an information disclosure issue, CVE-2021-42306, to prevent private key data from being stored by some Azure services in the keyCredentialsproperty of an Azure Active Directory Azure AD Applicationand/or Service Principal, and prevent reading of private key data...

アプリケーションおよびサービス プリンシパル API での Azure Active Directory (AD) keyCredential プロパティの情報漏えいに関するガイダンス

本ブログは、“Guidance for Azure Active Directory AD keyCredential property Information Disclosure in Application and Service Principal APIs” の抄訳版です。最新の情報は、原本...

CVE-2021-42306

creationtimestamp| type| source ---|---|--- 2021-11-17 07:00:00+00:00| seen| https://msrc.microsoft.com/blog/2021/11/guidance-for-azure-active-directory-ad-keycredential-property-information-disclosure-in-application-and-service-principal-apis/ 2021-11-18 13:13:22+00:00| published-proof-of-concep...

KLA12348 OSI vulnerability in Microsoft Azure

An information disclosure vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2021-42306 Related products Microsoft-Active-Directory Microsoft-Azure CVE list CVE-2021-42306 unknown Solution Install...

PT-2021-4858 · Microsoft · Azure Site Recovery +3

Name of the Vulnerable Software and Affected Versions: Azure Active Directory AAD affected versions not specified Azure Automation affected versions not specified Azure Site Recovery affected versions not specified Azure Migrate affected versions not specified Description: The issue is related to...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:3674-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3674-1 advisory. - An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the...

Microsoft Azure Active Directory Connect（ADC） 信息泄露漏洞

Microsoft Azure is an open, enterprise-class cloud computing platform from Microsoft Corporation USA. Microsoft Azure has a security vulnerability. No details of the vulnerability are currently available...

CVE-2021-26323

Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity...

The importance of identity and Microsoft Azure Active Directory resilience

I love hearing my colleagues explain how they came to the industry because so many of their stories are unusual. I’m surprised how often I hear that people got into computer science by some fortuitous accident. Although he loved computers from the time he was a kid, Oren Melzer never expected to...

The vulnerability of the Active Directory Federation Services (ADFS) service on Microsoft Windows operating systems, which allows attackers to perform spear-phishing attacks

The vulnerability of the Active Directory Federation Services ADFS for Microsoft Windows operating systems is related to information representation errors at the user interface level. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:3662-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3662-1 advisory. - Windows Active Directory AD domains have by default a feature to allow users to create computer accounts, controlled by ms-DS-MachineAccountQuota...

openSUSE 15 Security Update : samba (openSUSE-SU-2021:1471-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1471-1 advisory. - An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the...

openSUSE 15 Security Update : rubygem-activerecord-5_1 (openSUSE-SU-2021:1468-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1468-1 advisory. - The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service REDoS vulnerability...

Ad-Honeypot-Autodeploy - Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically. Runs on self-hosted virtualization using libvirt with QEMU/KVM but it can be customized easily for cloud-based solutions. Used for painlessly set up a small Windows Domain from scratch...

Total Domain Compromise

Total domain compromise is possible in samba:edge . Due to a flaw found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication, the Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos P...