14376 matches found
CVE-2026-55167
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...
CVE-2026-55167
Versions of LDAP Account Manager prior to 9.6 are vulnerable to a flaw where the WebAuthn authentication challenge is retained within the PHP session after the authentication response is processed. This allows a user who has completed valid password authentication to reuse the same signed WebAuth...
CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...
CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...
Weblogic_CVE-2020-14645
Weblogic CVE-2020-14645 coherence Deserialization Vulnerability Verification Program Environment Maven 3 JDK 1.8 Compilation mvn package Usage Specific testing steps: 1. Write the POC 2. Compile the POC into a class file 3. Start a static site to host the compiled POC 4. Start an LDAP proxy to...
CVE-2026-42568
CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication bypass. Field| Value ---|--- CVE|...
CVE-2026-93635
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...
CVE-2026-93635
The Zimbra Collaboration Suite (versions 10.1.0 through 10.1.21) is vulnerable to an LDAP filter injection caused by unescaped computeDn() template substitutions. This flaw allows unauthenticated attackers to manipulate external LDAP search filters. In environments utilizing search-filter authent...
CVE-2026-93635 Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...
EUVD-2026-101457
LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME...
CVE-2026-89068
Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89071
Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89071 MOVEit Transfer LDAP injection in certificate-based authentication
Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89071
Progress MOVEit Transfer is affected by an LDAP injection vulnerability within its LDAP module during certificate-based authentication. The root cause is the improper neutralization of special elements used in an LDAP query. This issue impacts versions before 2025.1.6 and versions from 2026.0.0 b...
EUVD-2026-101151
Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89071 MOVEit Transfer LDAP injection in certificate-based authentication
Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89068 MOVEit Transfer Authentication bypass in LDAP sign-on
Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89068
Progress MOVEit Transfer contains a vulnerability in its LDAP module caused by a missing critical step in authentication . This flaw allows for an authentication bypass, potentially impacting confidentiality, integrity, and availability. Affected versions include those before 2025.1.6 and version...
CVE-2026-89068 MOVEit Transfer Authentication bypass in LDAP sign-on
Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...