10230 matches found
The vulnerability of the Active Directory catalog service for Windows operating systems arises from the insecure management of privileges, allowing attackers to elevate their own privileges.
The vulnerability of the Active Directory catalog service for Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
Cross site scripting
A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...
CVE-2021-30807
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been...
systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
It was discovered that pamsystemd does not properly sanitize the environment before using the XDGSEAT variable. It is possible for an attacker, in some particular configurations, to set a XDGSEAT environment variable which allows for commands to be checked against polkit policies using the...
BlackMatter Ransomware
Summary Actions You Can Take Now to Protect Against BlackMatter Ransomware • Implement and enforce backup and restoration policies and procedures. • Usestrong, unique passwords. • Usemulti-factor authentication. • Implement network segmentation and traversal monitoring. Note: this advisory uses t...
WordPress Active Directory Integration / LDAP Integration plugin <= 3.6.94 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Active Directory Integration / LDAP Integration plugin versions = 3.6.94. Solution Update the WordPress Active Directory Integration / LDAP Integration plugin to the latest available version at least 3.6.95...
Active Directory Integration / LDAP Integration < 3.6.95 - Reflected Cross-Site Scripting
The plugin does not escape the testusername parameter before outputting it back in the settings page, leading to a Reflected Cross-Site Scripting issue PoC...
Active Directory Integration / LDAP Integration < 3.6.95 - Reflected Cross-Site Scripting
The plugin does not escape the testusername parameter before outputting it back in the settings page, leading to a Reflected Cross-Site Scripting issue alert/XSS/' /...
Active-Directory-Exploitation-Cheat-Sheet
This is a cheat sheet for Windows Active Directory exploitation, containing common enumeration and attack methods. The repository is a collection of PowerShell scripts and modules that can be used to perform various attacks on Active Directory, including domain enumeration, lateral movement, and...
The vulnerability of the Active Directory Federation Services (ADFS) on the Windows operating system allows a perpetrator to bypass the security measures.
The vulnerability of the Active Directory Federation Services AD FS on Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass security measures...
ForgeCert - "Golden" Certificates
ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was released ...
archTIS and Microsoft: Zero Trust information security for Microsoft Teams
Microsoft Teams has seen a surge in growth during the pandemic with over 115 million daily active users and growing.1 With it, customer imperative for enabling safe and trustworthy online collaboration has also increased significantly. The speed and simplicity of Teams business users creating new...
Zoho ManageEngine ADManager Plus Remote Code Execution Vulnerability (CNVD-2021-88239)
Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus Build 7111, which stems from not properly validating file uploads in the Personalization interface and ca...
Zoho ManageEngine ADManager Plus Remote Code Execution Vulnerability (CNVD-2021-88238)
Zoho ManageEngine ADManager Plus is an easy-to-use Windows Active Directory management and reporting solution. A remote code execution vulnerability exists in Zoho ManageEngine ADManager Plus Build 7111, which stems from not properly validating file uploads in the PasswordExpiry interface and can...
CVE-2021-41361
Active Directory Federation Server Spoofing Vulnerability...
CVE-2021-41361
Active Directory Federation Server Spoofing Vulnerability...
CVE-2021-41337
Active Directory Security Feature Bypass Vulnerability...
CVE-2021-41337
Active Directory Security Feature Bypass Vulnerability...
