CVE-2022-34916 Improper Input Validation (JNDI Injection) in JMSMessageConsumer

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

PT-2022-4369 · Apache · Apache Flume

Name of the Vulnerable Software and Affected Versions: Apache Flume versions 1.4.0 through 1.10.0 Description: The issue allows for a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI, and an attacker has control of the target LDAP server. Th...

Apache Flume 输入验证错误漏洞

Apache Flume is a distributed, reliable and available service from the Apache Foundation, USA. Used to efficiently collect, aggregate, and move large amounts of log data, versions of Apache Flume prior to 1.4.0 through 1.10.0 contain a security vulnerability that stems from vulnerability to remot...

Huawei EulerOS: Security Advisory for 389-ds-base (EulerOS-SA-2022-2264)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: libldb-2.4.4-1.fc35

An extensible library that implements an LDAP like API to access remote LDAP servers, or use local tdb databases...

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

Authentication flaw

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397

CVE-2022-37397 affects YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft AD. If anonymous or unauthenticated LDAP binding is enabled, authentication can be bypassed with an empty password. Connected sources provide no exploitation details. Practical impact is authentica...

CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397 The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

OESA-2022-1816 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue ...

OESA-2022-1817 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue ...

SUSE: Security Advisory (SUSE-SU-2022:2763-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2763-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommand bsc1189492. - Add 'ldapignoreunreadablereferences' parameter to skip unreadable objects referenced by 'member' attributte bsc1190775 - Fix 32-bi...

LDAP Injection Authentication Bypass

Lightweight Directory Access Protocol LDAP is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On SSO service that will allow clients to authenticate with a web site without any interaction assuming...

AlmaLinux 8 : 389-ds:1.4 (5823) (ALSA-2022:5823)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5823 advisory. 389-ds-base: sending crafted message could result in DoS CVE-2022-0918 389-ds-base: expired password was still allowed to access the database CVE-2022-099...

OESA-2022-1809 python-ldap security update

python-ldap provides an object-oriented API for working with LDAP within Python programs. It allows access to LDAP directory servers by wrapping the OpenLDAP 2.x libraries, and contains modules for other LDAP-related tasks including processing LDIF, LDAPURLs, LDAPv3 schema, etc.. Security Fixes:...

Use-After-Free

samba is vulnerable to use-after-free. The vulnerability exists because the AD DC database audit logging module can access LDAP message values freed by a preceding database module which allows an attacker to cause a memory corruption which then leads to an application crash...

Denial Of Service (DoS)

samba is vulnerable to denial of service attacks. An attacker is able to crash the server process with a crafted LDAP add or a modify request which allows an attacker to crash the application by providing a malicious input...

openSUSE: Security Advisory for ldb, (SUSE-SU-2022:2659-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...