CVE-2021-37933

The CVE-2021-37933 entry pertains to Huntflow Enterprise; an LDAP injection in /account/login could let an unauthenticated remote attacker bypass authentication by manipulating the email parameter used to build LDAP queries. Affected versions are prior to 3.10.6. Root cause: insufficient server-s...

CVE-2021-37933

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it...

How to Configure an LDAP Monitor on Citrix ADC

This article describes how to configure an LDAP monitor on Citrix ADC...

dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails

A flaw was found in dotnet, where the System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if the Transport Layer Security TLS handshake fails. This flaw allows an attacker to intercept sensitive information. The highest threat from this vulnerability is to...

October 12, 2021—KB5006669 (OS Build 14393.4704) - EXPIRED

None None...

PT-2021-7948 · Microsoft +4 · System.Directoryservices.Protocols +4

Name of the Vulnerable Software and Affected Versions: System.DirectoryServices.Protocols version 5.0.0 Description: A information disclosure issue exists where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux. This could allow a remote attacker to...

Jenkins Enterprise and Operations Center < 2.249.32.0.1 / 2.277.41.0.1 / 2.303.1.5 Bad Permissions (CloudBees Security Advisory 2021-08-25)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.x prior to 2.303.1.5, 2.249.x prior to 2.249.32.0.1, or 2.277.x prior to 2.277.41.0.1. It is, therefore, affected by a vulnerability when using RBAC. When using LDAP to grant users new permissions...

Security Bulletin: IBM Security Guardium Insights is affected by Components with known vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-15095 DESCRIPTION: Jackson Library could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization flaw in the readValue method of the...

CVE-2021-3825

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials...

Design/Logic Flaw

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials...

CVE-2021-3825

CVE-2021-3825 affects the Lider module of LiderAhenk software, specifically versions 2.1.15 and earlier. The root issue is leakage of configurations via an unsecured API, which can expose valid LDAP credentials to anyone with access to the configurations API. This creates a risk of unauthorized a...

CVE-2021-3825 Missing Authorization Checks in LiderAhenk

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials...

Debian DLA-2771-1 : krb5 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2771 advisory. Several vulnerabilities were fixed in MIT Kerberos, a system for authenticating users and services on a network. CVE-2018-5729 CVE-2018-5730 Fix flaws in LDAP DN...

[SECURITY] [DLA 2771-1] krb5 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2771-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 30, 2021 https://wiki.debian.org/LTS -...

SharpSpray - Active Directory Password Spraying Tool. Auto Fetches User List And Avoids Potential Lockouts

SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from inside and...

IBM Security Verify Bridge Information Disclosure Vulnerability (CNVD-2021-77465)

IBM Security Verify Bridge is an IBM application component from International Business Machines IBM, Inc. provides IBM Cloud access to user attributes and authentication that are controlled by the client's local LDAP or Active Directory. An information disclosure vulnerability exists in IBM...

IBM Security Verify Bridge Information Disclosure Vulnerability (CNVD-2021-77467)

IBM Security Verify Bridge is an IBM application component from International Business Machines IBM, Inc. Provides IBM Cloud access to user attributes and authentication that are controlled by the client's local LDAP or Active Directory for the IBM Cloud. An information disclosure vulnerability...

Samba 4.0.0 <= 4.0.10, 4.1.0 Information Disclosure Vulnerability (CVE-2013-4476)

Samba is prone to an information disclosure vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Samba 4.0.0 Bypass Restriction Vulnerability (CVE-2013-0172)

Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

IBM Security Verify Bridge Information Disclosure Vulnerability (CNVD-2021-77466)

IBM Security Verify Bridge is an IBM application component from International Business Machines IBM, Inc. provides IBM Cloud access to user attributes and authentication that are controlled by the client's local LDAP or Active Directory. An information disclosure vulnerability exists in IBM...