Astra Linux – Vulnerability in Bouncycastle

The Bouncy Castle For Java version prior to 1.74 is affected by an LDAP injection vulnerability. This vulnerability only affects applications that use the LDAP CertStore provided by Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the...

Astra Linux – Vulnerability in OpenLDAP

A flaw was discovered in ldapX509dn2bv in OpenLDAP before version 2.4.57, which led to a crash in slapd during X.509 DN parsing in adkeystring, resulting in a denial of service...

Astra Linux – Vulnerability in python-ldap

Python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, the sanitization method ldap.filter.escapefilterchars could be exploited to skip escaping special characters when a crafted list or dict was provided as the assertionvalue parameter, and...

MiracleLinux 9 : 389-ds-base-2.8.0-9.el9_8 (AXSA:2026-1635:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1635:06 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereferen...

CVE-2026-59780

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to...

CVE-2026-59780 Apache CloudStack: LDAP provider configuration disclosure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to...

EUVD-2026-63842

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers. LDAP configurations can be listed by any authenticated user with access to the listLdapConfigurations API. By default, this API is available to...

CVE-2026-59780

Apache CloudStack 's LDAP authentication plugin exposes sensitive LDAP provider configuration details through the listLdapConfigurations API, which is accessible by default to all standard user roles. This affects versions 4.2.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . An attacker with ...

SUSE CVE-2026-13097

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

PT-2026-79321

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP...

DEBIAN-CVE-2026-73199

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

CVE-2026-73199

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

DEBIAN-CVE-2026-13097

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

CVE-2026-13097

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

EUVD-2026-63246

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

CVE-2026-73199

FreeIPA 's ipa-enrollment SLAPI plugin crashes when a remote authenticated LDAP client omits the JOIN_OID request value in the extended operation, causing a null pointer dereference and server DoS. Red Hat recommends restricting LDAP network access to trusted clients or disabling the ipa-enrollme...

CVE-2026-73199 Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

CVE-2026-73199 Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

CVE-2026-73199

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

CVE-2026-13097 Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...