CVE-2020-2303

A cross-site request forgery CSRF vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials...

CVE-2020-2301

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is still in the optional cache when using Windows/ADSI mode...

CVE-2020-2302

A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page...

CVE-2020-2302

CVE-2020-2302 affects Jenkins Active Directory Plugin 2.19 and earlier, where a missing permission check allows attackers with Overall/Read permission to access the domain health check diagnostic page. The issue is fixed by upgrading to version 2.20, which enforces Overall/Administer permission f...

CVE-2020-2301

The CVE-2020-2301 issue affects Jenkins Active Directory Plugin (versions 2.19 and earlier). In Windows/ADSI mode, the plugin’s authentication cache could cause a login to be successful for any user with any password because the provided password was not validated when a cache entry existed. This...

CVE-2020-2299

CVE-2020-2299 affects Jenkins Active Directory Plugin versions 1.44–2.19 and certain older ranges, where the LDAP-based mode distinguishes user lookup from authentication by using a magic constant as the password due to shared code paths. This allows an attacker to log in as any user when the mag...

CVE-2020-2300

CVE-2020-2300 affects Jenkins Active Directory Plugin ≥2.19 and earlier. In Windows/ADSI mode the plugin does not prohibit empty passwords, enabling unauthorized logins to Jenkins depending on Active Directory server configuration. Mitigation: upgrade to version 2.20 or 2.16.1 which prohibit empt...

CVE-2020-2300

Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenkins as any user depending on the configuration of the Active Directory server...

samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results

A NULL pointer dereference, or possible use-after-free flaw was found in the Samba AD LDAP server. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to...

PT-2020-15533 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A cross-site request forgery CSRF issue allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers...

PT-2020-15530 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: The issue allows attackers to log in to Jenkins as any user by providing an empty password, depending on the configuration of the Active Directory server. This is possible...

PT-2020-15531 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Jenkins Active Directory Plugin versions prior to 2.20 and 2.16.1 Description: The issue allows attackers to log in as any user with any password while a successful authentication of...

PT-2020-15532 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.19 and earlier Description: A missing permission check in the Jenkins Active Directory Plugin allows attackers with Overall/Read permission to access the domain health check diagnostic page. This iss...

PT-2020-15529 · Jenkins · Jenkins Active Directory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 1.44 through 2.19 Jenkins Active Directory Plugin versions prior to 2.16.1 and 2.20 Description: The issue allows attackers to log in as any user if a magic constant is used as the password. This is du...

November 3, 2020, update for Office 2016 (KB4484397)

None None...

How to Prevent Pwned and Reused Passwords in Your Active Directory

Many businesses are currently looking at how to bolster security across their organization as the pandemic and remote work situation continues to progress towards the end of the year. As organizations continue to implement security measures to protect business-critical data, there is an extremely...

How to Prevent Pwned and Reused Passwords in Your Active Directory

Many businesses are currently looking at how to bolster security across their organization as the pandemic and remote work situation continues to progress towards the end of the year. As organizations continue to implement security measures to protect business-critical data, there is an extremely...

WARNING: Google Discloses Windows Zero-Day Bug Exploited in the Wild

Google has disclosed details of a new zero-day privilege escalation flaw in the Windows operating system that's being actively exploited in the wild. The elevation of privileges EoP vulnerability, tracked as CVE-2020-17087, concerns a buffer overflow present since at least Windows 7 in the Window...

Adaz - Automatically Deploy Customizable Active Directory Labs In Azure

This project allows you to easily spin up Active Directory labs in Azure with domain-joined workstations, Windows Event Forwarding, Kibana, and Sysmon using Terraform/Ansible. It exposes a high-level configuration file for your domain to allow you to customize users, groups and workstations...

Microsoft Windows Active Directory Remote Code Execution (CVE-2020-0718)

A remote code execution vulnerability exists in Microsoft Windows Active Directory. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...