10806 matches found
Guidance to mitigate unconstrained delegation vulnerabilities
Executive Summary Active Directory Forest trusts provide a secure way for resources in a forest to trust identities from another forest. This trust is directional; a trusted forest can authenticate its users to the trusting forest without allowing the reverse. A feature, Enforcement for forest...
Cumulative Update 1 for Exchange Server 2019
None None...
Cumulative Update 12 for Exchange Server 2016
None None...
Microsoft Exchange Server Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could gain the same rights as a Domain Administrator. Exploitation of this vulnerability requires Exchange Web Services EWS and Push Notifications to be enabled a...
Cumulative Update 22 for Exchange Server 2013
Cumulative Update 22 for Exchange Server 2013 Cumulative Update 22 for Microsoft Exchange Server 2013 was released on February 12, 2019. This cumulative update is a security update. This cumulative update includes fixes for nonsecurity issues and all previously released fixes for security and...
Cisco Aironet Active Sensor Trust Management Issues Vulnerability
Cisco Aironet Active Sensor is an active wireless network sensor from Cisco. The product is mainly used to monitor wireless network performance. The Cisco Aironet Active Sensor suffers from a trust management issue vulnerability that stems from the use of static passwords for default local...
PT-2019-18140 · Unknown · Modbus Gateway
Name of the Vulnerable Software and Affected Versions: Modbus gateway versions prior to Release R02 or Software Version 1.1.13166 Description: The issue allows an attacker to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted...
Ericsson Active Library Explorer (ALEX) 14.3 Cross Site Scripting
!-- Exploit Title: Cross Site Scripting in Ericsson Active Library Explorer Server Version 14.3 Date: 23-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: http://www.ericsson.com Software Link: http://www.ericsson.com Version: Ericsson Active Library Explorer Server Version 14.3 Tested on:...
CVE-2019-1675
A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker coul...
Default configuration
A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker coul...
CVE-2019-1675 Cisco Aironet Active Sensor Static Credentials Vulnerability
A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vulnerability is due to a default local account with a static password. The account has privileges only to reboot the device. An attacker coul...
CVE-2019-1675
CVE-2019-1675 affects Cisco Aironet Active Sensor. The issue arises from a default local account with a static password that provides privileges only to reboot the device; an unauthenticated, remote attacker can guess the account name/password to access the CLI and reboot the sensor, potentially ...
CVE-2019-1003009
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
CVE-2019-1003009
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
Input validation
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
CVE-2019-1003009
The CVE-2019-1003009 issue affects Jenkins Active Directory Plugin 2.10 and earlier. A improper certificate validation vulnerability exists in ActiveDirectoryDomain.java, ActiveDirectorySecurityRealm.java, and ActiveDirectoryUnixAuthenticationProvider.java that lets an attacker impersonate the Ac...
CVE-2019-1003009
An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/activedirectory/ActiveDirectoryDomain.java, src/main/java/hudson/plugins/activedirectory/ActiveDirectorySecurityRealm.java,...
Microsoft Confirms Serious 'PrivExchange' Vulnerability
Microsoft acknowledged an elevated privilege flaw in its Exchange Server could allow a remote attacker with a simple mailbox account to gain administrator privileges. Both a Microsoft advisory and a US-CERT alert were issued on Tuesday warning users of the elevation of privilege flaw, dubbed...
PT-2019-11307 · Jenkins · Jenkins Active Directory Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Active Directory Plugin versions 2.10 and earlier Description: An issue exists in the improper validation of certificates, allowing attackers to impersonate the Active Directory server that Jenkins connects to for authentication when...
UBUNTU-CVE-2019-7347
A Time-of-check Time-of-use TOCTOU Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records add/delete Monitors, Users, etc...