3988 matches found
CVE-2026-85982
The Auth0 AD/LDAP Connector is affected by a stored Cross-Site Scripting (XSS) vulnerability caused by improper HTML encoding in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes—or a low-privileged local user...
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
EUVD-2026-74185
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
CVE-2026-85981
The Auth0 AD/LDAP Connector (versions 6.5.0 and earlier ) has an unauthenticated administrative panel that listens on the local loopback interface without requiring credentials. A local, low-privileged user or process on the host can access the panel's management endpoints to read configuration d...
CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...
CVE-2026-72978
Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
CVE-2026-69821
Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
CVE-2026-69624
Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...
CVE-2026-69395
Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...
CVE-2026-62810
Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
CVE-2026-75156
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
EUVD-2026-73692
Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...
CVE-2026-69395
Active Directory Certificate Services (AD CS) contains a vulnerability caused by the use of an externally-controlled format string , allowing an authorized attacker (low privileges required) to disclose information over a network . The CVSS v3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR...
EUVD-2026-73569
Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
CVE-2026-69821
CVE-2026-69821 is a local privilege escalation vulnerability in Active Directory Certificate Services (AD CS) caused by improper encoding or escaping of output. An authorized attacker with low privileges can exploit it without user interaction to gain full compromise of confidentiality, integrity...
CVE-2026-69624
Active Directory Certificate Services (AD CS) is affected by an incomplete list of disallowed inputs , enabling an authorized attacker to perform tampering over a network . The root cause is that the input validation does not fully cover all disallowed values, allowing manipulation of certificate...