OpenAM 13.0 - LDAP Injection

Exploit Title: OpenAM 13.0 - LDAP Injection Date: 03/11/2021 Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...

CVE-2021-41232

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...

CVE-2021-41232

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...

Code injection

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...

CVE-2021-41232 Improper Neutralization of Special Elements used in an LDAP Query

Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in versio...

CVE-2021-41232

Summary: Thunderdome is affected by an LDAP injection vulnerability in the LDAP authentication path due to improper escaping of the supplied username. The flaw impacts affected versions prior to patch release 1.16.3 and has been addressed in 1.16.3. If upgrading is not feasible, disable LDAP auth...

CVE-2021-37933

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

CVE-2021-37933

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

Authentication flaw

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

CVE-2021-37933

The CVE-2021-37933 entry pertains to Huntflow Enterprise; an LDAP injection in /account/login could let an unauthenticated remote attacker bypass authentication by manipulating the email parameter used to build LDAP queries. Affected versions are prior to 3.10.6. Root cause: insufficient server-s...

CVE-2021-37933

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

ForgeRock OpenAM LDAP Injection

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol or the password reset feature. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key. No source data...

A1:Injection — Top 10 OWASP 2017

A1:Injection — Top 10 OWASP 2017 💉 Introduction Injection is an issue that arises quite often and in several forms, things like SQL databases for example might contain issues such as SQL injection and the same might go for things like LDAP, XML, OS commands,… . In other words, there is a range of...

rConfig <= 3.9.6 Multiple Vulnerabilities

rConfig is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

Design/Logic Flaw

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

CVE-2020-23148

CVE-2020-23148 affects rConfig 3.9.5 via a vulnerability in the LDAP login path. The issue is the unsanitized userLogin parameter in ldap/login.php , which can lead to a LDAP injection and potential exposure of sensitive information through a crafted POST request. Public references consistently d...

rConfig 注入漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig that stems from the unfiltered userLogin parameter in ldap/login.php in version 3.9.5 of rConfig. An attacker can use this vulnerability to perform ldap injection and obtain sensitive...