11775 matches found
bind-dyndb-ldap security update
1.1.0-0.9.b1.1 - fix CVE-2012-3429...
Barracuda EMail Security 2.0.2 Filter Bypass / XSS
Title: ====== Barracuda EMail Security 2.0.2 - Multiple Web Vulnerabilities Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=621 http://www.vulnerability-lab.com/getcontent.php?id=630 Barracuda Networks Security ID: BNSEC-304 VL-ID: ===== 621 Commo...
Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities
Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/54773/info Barracuda Email Security Service is prone to multiple HTML-injection vulnerabilities because it fails to properly validate user-supplied input. An attacker may leverage...
Barracuda Email Security Service - Multiple HTML Injection Vulnerabilities
source: https://www.securityfocus.com/bid/54773/info Barracuda Email Security Service is prone to multiple HTML-injection vulnerabilities because it fails to properly validate user-supplied input. An attacker may leverage these issues to inject hostile HTML and script code that would run in the...
Scientific Linux Security Update : dovecot on SL5.x i386/x86_64
A flaw was discovered in the way Dovecot handled the 'mailextragroups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. CVE-2008-1199 This issue did not affect the default Red Hat...
Scientific Linux Security Update : libuser on SL4.x, SL5.x i386/x86_64
It was discovered that libuser did not set the password entry correctly when creating LDAP Lightweight Directory Access Protocol users. If an administrator did not assign a password to an LDAP based user account, either at account creation with luseradd, or with lpasswd after account creation, an...
Scientific Linux Security Update : krb5 on SL5.x i386/x86_64
A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed principal names that were not null terminated, when the KDC was configured to use an LDAP back end. A remote attacker could use this flaw to crash the KDC via a specially crafted request. CVE-2011-0282 A denial of...
Scientific Linux Security Update : vixie-cron on SL5.x i386/x86_64 (20120221)
The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron. A race condition was found in the way t...
Scientific Linux Security Update : bind-dyndb-ldap on SL6.x i386/x86_64 (20120521)
The dynamic LDAP back end is a plug-in for BIND that provides back-end capabilities to LDAP databases. It features support for dynamic updates and internal caching that help to reduce the load on LDAP servers. A flaw was found in the way bind-dyndb-ldap handled LDAP query errors. If a remote...
Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20120620)
The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way the 389 Directory Server daemon ns-slapd handled access control instructions AC...
Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20120221)
The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the sudo password checking logic. In configurations where the sudoers settings allowed a user to run a command using sudo with only the group ID changed, sudo...
Scientific Linux Security Update : krb5 on SL6.x i386/x86_64
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. Multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when i...
Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20120620)
The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way 389 Directory Server handled password changes. If an LDAP user has changed thei...
Scientific Linux Security Update : sudo on SL6.x i386/x86_64
The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the sudo password checking logic. In configurations where the sudoers settings allowed a user to run a command using sudo with only the group ID changed, sudo...
Scientific Linux Security Update : openldap on SL5.x i386/x86_64
A flaw was found in the way OpenLDAP handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using OpenLDAP libraries into accepting it by mistake, allowing the...
Scientific Linux Security Update : nss_ldap on SL5.x i386/x86_64
A race condition was discovered in nssldap which affected certain applications which make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with information about a different user. CVE-2007-5794 In addition, these updated packages fix t...
Scientific Linux Security Update : nss_ldap on SL4.x i386/x86_64
A race condition was discovered in nssldap, which affected certain applications that make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with the information about a different user. CVE-2007-5794 As well, this updated package fixes t...
ldap injection in the custom atlassian authentication code
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47275. panel The custom atlassian ldap authentication code is vulnerable to ldap injection. The method which is vulnerable to ld...
ldap injection in the custom atlassian authentication code
The custom atlassian ldap authentication code is vulnerable to ldap injection. The method which is vulnerable to ldap injection is the searchUser method, where the 'filter' parameter third argument to the searchs ldap method is passed through without using ldap.filter on it first. The code should...
ldap injection in the custom atlassian authentication code
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47275. panel The custom atlassian ldap authentication code is vulnerable to ldap injection. The method which is vulnerable to ld...