CVE-2021-41232: Improper Neutralization of Special Elements used in an LDAP Query

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...

GitHub Security Lab: [Python] CWE-522: Insecure LDAP Authentication

This bug was reported directly to GitHub Security Lab...

How to Change Password for LDAP Authentication for NetScaler Gateway and AAA-TM Users

This article provides information on how LDAP password change can be achieved for NetScaler Gateway and AAA-TM users. Prerequisite NetScaler 10.1.x onwards...

Security Bulletin: IBM Data Replication Management Console Authentication By-pass against LDAP directories using anonymous binding

Summary This bulletin covers a vulnerability found in the Management Console client under which authentication may be by-passed if configured to authenticate against LDAP directories allowing anonymous binding. Vulnerability Details CVEID: CVE-2020-4821 DESCRIPTION: IBM Cognos Controller, under...

Medium: 389-ds-base

Issue Overview: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. CVE-2020-35518 Affected Packages: 389-ds-base Note:...

CVE-2020-35177

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1...

Security Bulletin: Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials (CVE-2015-1772, CVE-2015-1836).

Summary Infosphere BigInsights is affected by vulnerabilities in Apache HBase and Hive that could allow a remote attacker to gain unauthorized access to the system or authenticate with improper credentials CVE-2015-1772 , CVE-2015-1836. Vulnerability Details CVEID: CVE-2015-1772 DESCRIPTION: Apac...

Design/Logic Flaw

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind...

CVE-2021-21484

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind...

CVE-2021-21484: Incorrect Authorization

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind...

PT-2021-14550

Name of the Vulnerable Software and Affected Versions SAP HANA Database version 2.0 Description The issue allows LDAP authentication in SAP HANA Database to be bypassed if the attached LDAP directory server is configured to enable unauthenticated bind. Recommendations For SAP HANA Database versio...

thorn-linux

This is a Debian-based research and development platform for information security called Thorn Linux. It is designed to keep users up to date with the latest cybersecurity news while providing a hardened and anonymized penetration-testing environment. The platform includes a highly customized...

LDAP authentication failed with error code 4003 and Group length is very large

One user cannot login Gateway with LDAP authentication and other users can login normally...

GitHub Security Lab: [Java] CWE-522: Insecure LDAP authentication

This bug was reported directly to GitHub Security Lab...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

CVE-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

Unable to use TLS/SSL LDAP Auth after ADM upgrade to latest build 13.0-71.40 - TLS Handshake fails with "Unknown CA"

After upgrading ADM to latest build 13.0-71.40 External Authentication fails when LDAP Server is configured using Security type SSL and TLS. When retrieving Attributes on LDAP Server config from ADM GUI throw this error :: "LDAP IP Address or Port Number provided is invalid." Network trace shows...

CVE-2020-26288

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping...

Authentication flaw

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping...