CVE-2022-40145

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

Code injection

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

CVE-2022-40145

Apache Karaf prior to 4.4.2 and 4.3.8 is affected by CVE-2022-40145 due to a lack of validation in JDBCUtils.doCreateDatasource when a JNDI LDAP data source URI is used. An attacker who controls the target LDAP server can trigger remote code execution by injecting a crafted JNDI name into Initial...

CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

LDAP Active Directory - trustedDomain Enumeration

Binary data ldapenumtrusteddomain.nbin...

CVE-2022-47581

Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request...

CVE-2022-47581

Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request...

Apache Karaf 安全漏洞

Apache Karaf is a lightweight OSGi Java Dynamic Modular System container for deploying applications and components from the Apache Foundation. A security vulnerability exists in Apache Karaf versions prior to 4.3.8 and 4.4.x prior to 4.4.2, which stems from the use of JNDI LDAP data URIs configur...

CVE-2022-47581

CVE-2022-47581 affects Isode M-Vault servers, specifically versions 16.0v0 through 17.x prior to 17.0v24. The issue causes a crash when handling an LDAP v1 bind request, with CVSS v3.1 base score 7.5 (HIGH) and network attack vector, no user interaction required. Remediation: upgrade to 17.0v24 o...

PT-2022-25242 · Apache · Apache Karaf

Name of the Vulnerable Software and Affected Versions: Apache Karaf versions prior to 4.4.2 and 4.3.8 Description: This issue is about a potential code injection when an attacker has control of the target LDAP server using the JDBC JNDI URL. The function...

PT-2022-28077 · Isode · Isode M-Vault

Name of the Vulnerable Software and Affected Versions: Isode M-Vault versions 16.0v0 through 17.x before 17.0v24 Description: The issue causes Isode M-Vault to crash when it receives an LDAP v1 bind request. Recommendations: For versions 16.0v0 through 17.x before 17.0v24, update to version 17.0v...

CVE-2022-45046

This flaw targets the camel-ldap package. According to the maintainers this CVE should be retracted soon. Mitigation Maintainers have added a documentation detail regarding LDAP Injection in Camel LDAP component. Please check the link for more information...

CVE-2022-42445

HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches...

CVE-2022-42445

HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches...

Code injection

HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches...

Debian: Security Advisory (DSA-5298-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux AMI : samba (ALAS-2022-1642)

The version of samba installed on the remote host is prior to 4.10.16-20.62. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1642 advisory. It was found that the Kerberos Key Distribution Center KDC delegation feature, Service for User S4U, did not sufficient...

[SECURITY] [DSA 5298-1] cacti security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5298-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 09, 2022 https://www.debian.org/security/faq -...

Amazon Linux 2022 : log4j (ALAS2022-2022-225)

The version of log4j installed on the remote host is prior to 2.17.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-225 advisory. - Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in...