openSUSE: Security Advisory for 389-ds (openSUSE-SU-2022:1100-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Ubuntu 20.04 LTS : H2 vulnerabilities (USN-5365-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5365-1 advisory. It was discovered that H2 was vulnerable to deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:1100-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1100-1 advisory. - CVE-2022-0918: Fixed a potential denial of service via crafted packet bsc1197275. - CVE-2022-0996: Fixed a mishandling of passwor...

CVE-2022-1162

GitLab CVE-2022-1162 affects GitLab CE/EE versions 14.7 before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. Root cause: a hardcoded password was set for accounts registered via OmniAuth providers (OAuth, LDAP, SAML), enabling potential account takeover. Impact: high-risk credential exposur...

OPENSUSE-SU-2022:1100-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2022-0918: Fixed a potential denial of service via crafted packet bsc1197275. - CVE-2022-0996: Fixed a mishandling of password expiry bsc1197345. - Resolved LDAP-Support not working with DHCP by adding required schema bsc1194068 - Resolved...

SUSE-SU-2022:1100-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2022-0918: Fixed a potential denial of service via crafted packet bsc1197275. - CVE-2022-0996: Fixed a mishandling of password expiry bsc1197345. - Resolved LDAP-Support not working with DHCP by adding required schema bsc1194068 - Resolved...

Aiven Ltd: Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

Summary: When configuring the connector via the Aiven API or the Kafka Connect REST API, the attacker can set the database.history.producer.sasl.jaas.config connector property for the io.debezium.connector.mysql.MySqlConnector connector. This is likely true for other debezium connectors too. By...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2021-39031)

Summary IBM WebSphere Liberty is shipped as a component of IBM Tivoli Netcool Impact. Information about a security vulnerability affecting IBM WebSphere Liberty has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server -...

Security update for 389-ds (important)

openSUSE Security Update: Security update for 389-ds Announcement ID: openSUSE-SU-2022:1100-1 Rating: important References: 1194068 1194084 1197275 1197345 Cross-References: CVE-2022-0918 CVE-2022-0996 CVSS scores: CVE-2022-0918 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0918...

Fedora: Security Advisory for 389-ds-base (FEDORA-2022-40544b5314)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Authentication Bypass

cacti is vulnerable to authentication bypass. The vulnerability exists under certain ldap conditions which allows an attacker to bypass cacti authentication...

curl: CVE-2022-22576: OAUTH2 bearer bypass in connection re-use

Summary: A cached connection authenticated with the OAUTH2 mechanisms can be reused by a subsequent request even if the bearer is not correct. This affects SASL-enabled protcols: SMPTPS, IMAPS, POP3S and LDAPS openldap only. An application that can be accessed by more than one user such as a...

Fedora: Security Advisory for bind-dyndb-ldap (FEDORA-2022-042d9c6146)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: bind-dyndb-ldap-11.9-9.fc34

This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...

Fedora: Security Advisory for bind-dyndb-ldap (FEDORA-2022-14e36aac0c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: bind-dyndb-ldap-11.9-14.fc36

This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...

Metasploit Weekly Wrap-Up

Capture Plugin Capturing credentials is a critical and early phase in the playbook of many offensive security testers. Metasploit has facilitated this for years with protocol-specific modules all under the auxiliary/server/capture. Users can start and configure each of these modules individually,...

ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON. AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool...

Fedora: Security Advisory for bind-dyndb-ldap (FEDORA-2022-427cfc50f8)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: IBM Transformation Extender Advanced is vulnerable to LDAP injection due to WebSphere Application Server Liberty (CVE-2021-39031)

Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. An LDAP injection vulnerability in IBM WebSphere Application Server Liberty has been addressed. Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION...