11502 matches found
CVE-2023-29056
CVE-2023-29056 affects Lenovo XClarity Controller (XCC). Under specific conditions, a valid LDAP user will default to read-only permissions during authentication if XCC is configured to use an LDAP server for Authentication/Authorization and the login permission attribute is not defined. Multiple...
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
CVE-2023-29057
CVE-2023-29057 affects Lenovo XClarity Controller (XCC). A valid XCC user’s local account permissions can override their Active Directory permissions under specific LDAP configurations labeled as “Local First, then LDAP,” enabling privilege escalation. Documented impact includes high confidential...
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
WordPress Active Directory Integration / LDAP Integration Plugin < 4.1.1 is vulnerable to Sensitive Data Exposure
Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions 4.1.1 Fixed in 4.1.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-0812 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 79df970a00a6...
Debian: Security Advisory (DLA-3399-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian dla-3399 : 389-ds - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3399-1 [email protected]...
USN-5993-1: Samba vulnerabilities | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Demi Marie Obenour discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitiv...
OESA-2023-1248 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.CVE-2023-0922...
Security fix for the ALT Linux 9 package adcli version 0.9.2-alt1
0.9.2-alt1 built April 21, 2023 Evgeny Sinelnikov in task 314224 Oct. 17, 2022 Evgeny Sinelnikov - Add support LDAP add/mod operation to set/change password: + fix unable to join to active directory after KB5008380/CVE-2021-42287 with option '--ldap-passwd'; +...
Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure
The plugin does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure. In version 4.1.0 a nonce check was added to the request, but it still lacked authorization. PoC The admininit hook calls MoLdapLocalLogin class loginwidgetsaveoptions...
Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure
The plugin does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure. In version 4.1.0 a nonce check was added to the request, but it still lacked authorization. The admininit hook calls MoLdapLocalLogin class loginwidgetsaveoptions meth...
Moderate: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
OESA-2023-1232 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.CVE-2023-0922...
[SECURITY] Fedora 36 Update: libldb-2.5.3-1.fc36
An extensible library that implements an LDAP like API to access remote LDAP servers, or use local tdb databases...
Fedora 36 : libldb / samba (2023-1c172e3264)
The remote Fedora 36 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-1c172e3264 advisory. Update to ldb 2.5.3 and samba 4.16.10 Security fixes for CVE-2023-0922, CVE-2023-0614 Tenable has extracted the preceding description block directly...
CVE-2018-17455
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals"...
Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server
CVE-2023-21839 Due to special requirements, the GO version of...
CVE-2018-17455
CVE-2018-17455 affects GitLab Enterprise Edition listed in the initial description: versions before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The root cause is an insecure direct object reference in the Merge Request Approvals feature, allowing an attacker to disclose sensitive info...
CVE-2018-17455
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals"...