OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...

GHSA-68R5-9HPG-7QW9 OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the opendj-dsml-servlet process. An attacker can access internal services, read local files, or exhaust server memory by submitting specially crafted DSML add/modify requests containing malicious URIs...

PT-2026-67586

The DSMLv2 SOAP gateway opendj-dsml-servlet in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker...

org.openidentityplatform.openam:embedded.opendj (>=14.5.2.1, <=15.0.0.1), org.openidentityplatform.openam:openam-slf4j (>=14.5.2, <=15.1.4) +6 more potentially affected by CVE-2025-27497 via org.openidentityplatform.opendj:opendj-server-legacy (>=4.4.7, <=4.9.2)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version =4.4.7, =14.5.2.1, =14.5.2, =4.4.12, =4.6.4, =4.4.7, =4.4.7, =4.4.7, =4.4.15, =4.9.2 Source cves: CVE-2025-27497 Source advisory: GHSA-93QR-H8PR-4593...

ZDI-10-075: Sun Microsystems Directory Server Enterprise DSML UTF-8 Denial of Service Vulnerability

ZDI-10-075: Sun Microsystems Directory Server Enterprise DSML UTF-8 Denial of Service Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-075 April 13, 2010 -- CVE ID: CVE-2010-0897 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Directory Server --...

Sun Microsystems Directory Server DSML-over-HTTP Username Search Denial of Service Vulnerability

This vulnerability allows attackers to deny services on vulnerable installations of Sun Microsystems Directory Service Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within Sun Directory Server's DSML-over-HTTP implementation and can be triggered v...

Sun Microsystems Directory Server Enterprise DSML UTF-8 Denial of Service Vulnerability

This vulnerability allows attackers to deny services on vulnerable installations of Sun Microsystems Directory Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within Sun Directory Server's DSML-over-HTTP implementation and can be triggered via an HTT...