[SECURITY] Fedora 37 Update: libldb-2.6.2-1.fc37

An extensible library that implements an LDAP like API to access remote LDAP servers, or use local tdb databases...

Fedora 37 : libldb / samba (2023-fca3bfed78)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-fca3bfed78 advisory. Update to ldb 2.6.2 and samba 4.17.7 Security fixes for CVE-2023-0225, CVE-2023-0922, CVE-2023-0614 Tenable has extracted the preceding description...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect Cloud Pak System (CVE-2022-34165, CVE2021-39031)

Summary Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect Cloud Pak System . Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Applicatio...

CVE-2023-0614

A vulnerability was found in Samba. Confidential attribute disclosure via LDAP filters is insufficient, which may allow an attacker to obtain confidential BitLocker recovery keys from a Samba AD DC...

SUSE CVE-2023-0614

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC...

ForgeRock Access Management 6.0.0.x / 6.5.0.x / 6.5.2.x / 6.5.3 / 6.5.4 / 7.0.x / 7.1 / 7.1.1 Multiple Vulnerabilities

The version of ForgeRock Access Management detected on the remote host is affected by multiple vulnerabilities, including the following: - It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network service...

SUSE SLES15 Security Update : ldb, samba (SUSE-SU-2023:1687-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1687-1 advisory. - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a...

SUSE SLES15: ctdb / libdcerpc-binding0 / libdcerpc-binding0-32bit / etc (SUSE-SU-2023:1682-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1682-1 advisory. - CVE-2023-0922: Fixed Samba AD DC admin tool samba-tool sending passwords in cleartext bso15315 bsc1209481. Tenable has...

SUSE SLED15: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (SUSE-SU-2023:1689-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1689-1 advisory. ldb: - CVE-2022-32746: Fixed an use-after-free issue in the database audit logging module...

SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2023:1684-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1684-1 advisory. - CVE-2023-0922: Fixed Samba AD DC admin tool samba-tool sending passwords in cleartext bso15315 bsc1209481. Tenable has extracted the...

CVE-2023-1656

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server RCS LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server RCS: from 1.5.20.9 throug...

CVE-2023-1656

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server RCS LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server RCS: from 1.5.20.9 throug...

Code injection

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server RCS LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server RCS: from 1.5.20.9 throug...

CVE-2023-1656 When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server RCS LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server RCS: from 1.5.20.9 throug...

CVE-2023-1656 When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server RCS LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server RCS: from 1.5.20.9 throug...

CVE-2023-1656

CVE-2023-1656 affects ForgeRock OpenIDM and the Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, and Linux. The root cause is cleartext transmission of LDAP BIND credentials before TLS, leading to potential exposure of credentials for OpenIDM and RCS versions 1.5.20.9–1.5.20.1...

Security Bulletin: LDAP vulnerability affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in LDAP authentication affects IBM SAN Volume Controller, IBM Storwize V7000, IBM Storwize V5000 and V5100, IBM Storwize V5000E, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud, IBM FlashSystem V9000, IBM FlashSystem 9100 Family, IBM FlashSystem...

Security Bulletin: Vulnerability in OpenSSL affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in OpenSSL may cause a denial of service when IBM Spectrum Virtualize is acting as a TLS client when connecting to LDAP servers or key servers. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the...

Security Bulletin: MFA may be bypassed for LDAP users in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary LDAP users which are configured to require Multifactor Authentication MFA can still authenticate to the Common Information Model CIM interface using only username and password, which will allow them to perform a subset of configuration actions described here:...

Okta LDAP Agent 安全漏洞

Okta LDAP Agent is an agent software from Okta USA. A code issue vulnerability exists in Okta LDAP Agent versions prior to 5.18. An attacker can exploit this vulnerability to execute arbitrary code...