ShadowSpray - A Tool To Spray Shadow Credentials Across An Entire Domain In Hopes Of Abusing Long Forgotten GenericWrite/GenericAll DACLs Over Other Objects In The Domain

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the domain. Why this tool In a lot of engagements I see in BloodHound that the group "Everyone" / "Authenticated Users" / "Domain Users" or some other...

CVE-2023-0812 Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure...

CVE-2023-0812

CVE-2023-0812 affects the WordPress plugin Active Directory Integration / LDAP Integration (pre-4.1.1). The issue is unauthenticated data disclosure due to improper authorization or nonce handling on certain POST requests. A fix exists in version 4.1.1; affected users should upgrade to 4.1.1 or l...

WordPress plugin Active Directory Integration / LDAP Integration 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. An information disclosure vulnerability exists in the...

WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.4 is vulnerable to SQL Injection

Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2484 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 166c0938a64d Credits Marco Wotschka...

pki-core security, bug fix, and enhancement update

jss 5.3.0-1 - Rebase to JSS 5.3.0 5.3.0-0.3.beta2 - Rebase to JSS 5.3.0-beta2 - Bug 2017098 - pki pkcs12-cert-add command failing with 'Unable to validate PKCS 12 file: Digests do not match' exception 5.3.0-0.2.beta1 - Rebase to JSS 5.3.0-beta1 ldapjdk 5.3.0-1 - Rebase to LDAP SDK 5.3.0...

bind security and bug fix update

32:9.16.23-11 - Correct backport issue in statistics rendering fix 2126912 32:9.16.23-10 - Handle subtle difference between upstream and rhel CVE-2022-3094 32:9.16.23-9 - Prevent flooding with UPDATE requests CVE-2022-3094 - Handle RRSIG queries when server-stale is active CVE-2022-3736 - Fix cra...

WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.4 is vulnerable to SQL Injection

Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2599 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID adebea5f18df Credits Marco Wotschka...

AlmaLinux 9 : krb5 (ALSA-2023:2570)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2570 advisory. - Kerberos Security Feature Bypass Vulnerability CVE-2020-17049 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SUSE SLED15: antlr3-bootstrap-tool / antlr3-java / antlr3-java-javadoc / etc (SUSE-SU-2023:2097-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2097-1 advisory. maven: - Version update from 3.8.5 to 3.8.6 jscSLE-23217: Security fixes: - CVE-2021-42550: Update Versio...

Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2023-1879)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-28283

Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

CVE-2023-28283 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

CVE-2023-28283

CVE-2023-28283 is a Windows LDAP remote code execution vulnerability. Connected sources describe an unauthenticated RCE in the Windows LDAP service triggered by specially crafted LDAP requests, with the issue classified as high/critical in May 2023 updates. Root cause and exact impact are not dee...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

...

KB5026426: Windows Server 2008 R2 Security Update (May 2023)

The remote Windows host is missing security update 5026426. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

KB5026368: Windows 11 version 21H2 Security Update (May 2023)

The remote Windows host is missing security update 5026368. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...

KB5026409: Windows 8.1 Embedded and Windows Server 2012 R2 Security Update (May 2023)

The remote Windows host is missing security update 5026409. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-24943 - Windows Lightweight Directory Access Protocol LDAP Remote Code Execution Vulnerability...