758 matches found
Password stored in plain text
Overview parse-server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication ...
CVE-2020-26288 Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping...
CVE-2020-26288
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping...
CVE-2020-26288: Cleartext Storage of Sensitive Information
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping...
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to preven...
PT-2020-16406 · Parse · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.5.0 Description: The issue involves the storage of user passwords in cleartext for LDAP authentication. This occurs in Parse Server when user passwords are not stripped after authentication, leading to clearte...
CVE-2020-35177
CVE-2020-35177 affects HashiCorp Vault and Vault Enterprise; versions 1.4.1 and later allowed user enumeration through the LDAP authentication method. The issue is mitigated by upgrading to 1.5.6 or 1.6.1, which fix the vulnerability. The available connected documents confirm the vulnerability is...
UBUNTU-CVE-2020-1778
When OTRS uses multiple backends for user authentication with LDAP, agents are able to login even if the account is set to invalid. This issue affects OTRS; 8.0.9 and prior versions...
OTRS ITSM 授权问题漏洞
OTRS ITSM is a suite of foundational solutions for IT service management organizations from OTRS Germany. The solution is based on ITIL best practices and provides management tools for request and fault management, problem management, change management and release management. A security...
CVE-2020-26168
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users clients/members can be authenticated even if they provide invalid password...
CVE-2020-26542
An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Microsoft’s Active Directory, Percona has discovered a flaw that would allow authentication to complete when passing a blank value for the...
LDAP authentication vulnerability in Access Gateway Advanced Access Control
Description of Problem If the Advanced Access Control option AAC of Access Gateway is configured to use LDAP authentication then it is possible for a user to logon without supplying valid credentials. This vulnerability only affects AAC Version 4.2 deployments that are using LDAP authentication;...
PT-2020-16325
Name of the Vulnerable Software and Affected Versions Hazelcast IMDG Enterprise versions 4.0.0 through 4.0.2 Hazelcast Jet Enterprise versions 4.0.0 through 4.2 Description The LDAP authentication method in LdapLoginModule does not properly verify passwords in certain system-user-dn scenarios,...
CVE-2020-26214 LDAP authentication bypass in Alerta
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for...
PT-2020-16344
Name of the Vulnerable Software and Affected Versions Alerta versions prior to 8.1.0 Description The issue allows users to bypass LDAP authentication by providing an empty password when the Alerta server is configured to use LDAP as the authorization provider. This affects deployments where LDAP...
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-58752)
MySQL Server mysqld is the MySQL server, the main program that performs most of the work in a MySQL installation. A security vulnerability exists in the Server: Security: LDAP Auth component in Oracle MySQL Server 8.0.21 and earlier. An attacker can exploit this vulnerability to take over MySQL...
UBUNTU-CVE-2020-14869
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...
UBUNTU-CVE-2020-14771
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to...
UBUNTU-CVE-2020-14878
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware...
