CVE-2015-5246

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

Technical details about CVE-2015-5246 are not publicly available in the provided connected documents. The sources summarize an LDAP authentication issue in Foreman but do not specify affected versions, exploit methods, or fixes. Monitor for updates.

[20171101] - Core - LDAP Information Disclosure

Inadequate escaping in the LDAP authentication plugin can result in disclosure of username and password...

Login With Empty Credential

github.com/go-ldap/ldap allows the user to login with empty password or credentials. The vulnerability is only affects applications with the following conditions: - authorization of a user is performed by relying on the return error of the Bind function call i.e., a nil return is considered...

Amazon Linux AMI : 389-ds-base (ALAS-2017-905)

Password brute-force possible for locked account due to different return codes : A flaw was found in the way 389-ds-base handled authentication attempts against locked accounts. A remote attacker could potentially use this flaw to continue password brute-forcing attacks against LDAP accounts,...

Medium: 389-ds-base

Issue Overview: Password brute-force possible for locked account due to different return codes: A flaw was found in the way 389-ds-base handled authentication attempts against locked accounts. A remote attacker could potentially use this flaw to continue password brute-forcing attacks against LDA...

[SECURITY] Fedora 25 Update: php-horde-passwd-5.0.7-1.fc25

An application to change any user passwords stored in various backends like SQL, LDAP, Kolab, passwd files etc...

[SECURITY] Fedora 27 Update: php-horde-passwd-5.0.7-1.fc27

An application to change any user passwords stored in various backends like SQL, LDAP, Kolab, passwd files etc...

[SECURITY] Fedora 26 Update: php-horde-passwd-5.0.7-1.fc26

An application to change any user passwords stored in various backends like SQL, LDAP, Kolab, passwd files etc...

Code injection

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2016-10512

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2016-10512

MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext...

CVE-2016-10512

The CVE affects MultiTech FaxFinder prior to 4.1.2, where passwords used for testing LDAP connectivity are stored unencrypted. The credentials can be retrieved by the system when the LDAP configuration page is opened and are embedded in the HTML source in cleartext, creating high-risk exposure of...

[SECURITY] Fedora 26 Update: pure-ftpd-1.0.46-2.fc26

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

Privilege escalation

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1539

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1539

IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807...

CVE-2017-1539

IBM BPM is affected by CVE-2017-1539 for privilege escalation caused by failing to distinguish internal group memberships from user registry group memberships; manipulating LDAP group membership can grant privileged access. Affected versions include BPM 7.5.0.0–7.5.1.2, 8.0.0.0–8.0.1.3, 8.5.0.0–8...

Joomla LDAP Information Disclosure (CVE-2017-14596)

A LADP information disclosure vulnerability exists in Joomla!. Successful exploitation of this vulnerability allows an unprivileged remote attacker to extract all authentication credentials of the effected system...

Error "Could not update master user list" while saving the LDAP Configuration on XenMobile server

Unable to save LDAP configuration and getting Error "Could not update master user list" For sample logs: 2017-08-21T09:21:30.411-0700 | 3811F15F6AE686BC | INFO | http-nio-14443-exec-11 | com.citrix.cg.identity.ldap.LdapManager | Given baseDN 'dc=domain,dc=example,dc=com'is valid:true...