CVE-2020-1958: Improper Neutralization of Special Elements in Output Used by a Downstream Component

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based...

Authorization

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

CVE-2019-6195

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

CVE-2019-6195: Improper Privilege Management

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

PT-2020-11198

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller versions prior to 3.08 CDI340V Lenovo XClarity Controller versions prior to 3.01 TEI392O Lenovo XClarity Controller versions prior to 1.71 PSI328N Description An authorization bypass exists where a valid authenticate...

CVE-2020-8953

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

CVE-2020-8953

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

CVE-2020-8953: Improper Authentication

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

PT-2020-20391

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 2.8.0 through 2.8.0 Description The issue allows LDAP authentication bypass, except when a user is enrolled in two-factor authentication. Recommendations For OpenVPN Access Server versions 2.8.0 through 2.8.0,...

Lenovo XClarity Controller (XCC) Vulnerability - Lenovo Support US

No description provided...

Debian DSA-4612-1 : prosody-modules - security update

It was discovered that the LDAP authentication modules for the Prosody Jabber/XMPP server incorrectly validated the XMPP address when checking whether a user has admin access. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...

Debian: Security Advisory (DSA-4612-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4612-1] prosody-modules security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4612-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 31, 2020 https://www.debian.org/security/faq -...

PT-2019-15945

Name of the Vulnerable Software and Affected Versions NeuVector version 3.1 Description The issue allows an attacker with access to the NeuVector portal to authenticate as any valid LDAP user by providing a valid username and an empty password, given that the Active Directory server has not been...

Red Hat Keycloak Authorization Issue Vulnerability (CNVD-2020-00258)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An authorization issue vulnerability exists in Red Hat Keycloak version 7.x, which can be exploited by an attacker to perform LDAP authenticati...

LimeSurvey < 3.17.14 Multiple Vulnerabilities

LimeSurvey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-16180

Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used...

CVE-2019-16180

LimeSurvey prior to 3.17.14 is affected. The vulnerability allows remote attackers to brute-force the login form and enumerate usernames when LDAP authentication is used. Root cause details are not expanded in the provided documents beyond this behavior. Impact is described as login brute-forcing...

CVE-2019-16180

Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used...

PT-2019-14560

Name of the Vulnerable Software and Affected Versions Limesurvey versions prior to 3.17.14 Description The issue allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used. Recommendations For versions prior to 3.17.14, update to versi...