3996 matches found
PT-2021-6858
Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4.6 and below Description The issue is related to an improper validation of certificate with host mismatch, which may allow the connection to a malicious LDAP server via options in the GUI. This could lead to the disclosure ...
CentOS 8 : sssd (CESA-2021:3151)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3151 advisory. - sssd: shell command injection in sssctl CVE-2021-3621 Note that Nessus has not tested for this issue but has instead relied only on the application's...
Security Bulletin: IBM Security Identity Manager Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20483, CVE-2021-20488)
Summary IBM has announced a release for IBM Security Identity Manager Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern server side request forgery and account take over. Vulnerability Details CVEID: CVE-2021-20483 DESCRIPTION...
PT-2021-10415
Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /ad js.php API endpoint. Recommendations: For BlueCMS version 1.6, update to a version that contains a fix for...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
Cross site request forgery (csrf)
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
CVE-2021-21679
CVE-2021-21679 concerns Jenkins Azure AD Plugin 179.vf6841393099e and earlier, where an extension point for CSRF protection is too permissive, allowing attackers to craft URLs that bypass CSRF protection for any Jenkins URL. The issue is tied to a vulnerability in the plugin’s handling of CSRF to...
CVE-2021-21679: Cross-Site Request Forgery (CSRF)
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
PT-2021-14722 · Jenkins · Jenkins Azure Ad Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Azure AD Plugin versions 164.v5b48baa961d2 through 179.vf6841393099e Description: The issue allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. This is due to an overly permissive...
Jenkins 安全漏洞
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. Jenkins Azure AD Plugin has a security vulnerability through which an attacker can bypass CSRF protection...
PSPKIAudit - PowerShell toolkit for auditing Active Directory Certificate Services (AD CS)
PowerShell toolkit for auditing Active Directory Certificate Services AD CS. It is built on top of PKISolution's PSPKI toolkit Microsoft Public License. This repo contains a newer version of PSPKI than what's available in the PSGallery see the PSPKI directory. Vadims Podans the creator of PSPKI...
Bogus Cryptomining Apps Infest Google Play
Google has removed eight deceptive mobile apps from the Play Store that masquerade as cryptocurrency cloud-mining applications but which really exist to lure users into expensive subscription services and other fraudulent activity. They may have been removed, but researchers at Trend Micro noted...
Exploit for Improper Authentication in Microsoft
PoC exploit for CVE-2021-36949, a vulnerability in Azure AD Conn...
CVE-2021-36942
Windows LSA Spoofing Vulnerability Recent assessments: jbaines-r7 at January 25, 2022 4:35pm UTC reported: Recently, I was attempting to combine James Forshaw’s remote EFSRPC file write “bug” with a local privilege escalation that I’d discovered. I was getting strange results. Working on one...
Security Update for Microsoft Azure Active Directory Connect (August 2021)
An authentication bypass exists in Microsoft Azure Active Directory Connect. An attacker with domain user credentials may perform a man-in-the-middle between a domain controller and the Azure AD Connect server to exploit this vulnerability. Note that Nessus has not tested for this issue but has...
WordPress Ad Blocker Notify Lite plugin <= 2.4.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Ad Blocker Notify Lite plugin versions = 2.4.0. Solution 2021-08-25 - no patched version is available. Deactivate and delete...
