CVE-2022-0730

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types...

CVE-2021-38266

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...

CVE-2021-38266

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...

CVE-2021-38266

The CVE-2021-38266 issue affects the Portal Security module in Liferay Portal up to version 7.2.1 and Liferay DXP up to 7.2 (and older 7.0/7.1) where LDAP user import can fail, enabling remote attackers to prevent a legitimate user from authenticating by signing in as an LDAP user.根 The root caus...

CVE-2021-38266

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign ...

PT-2022-10706 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.1 and earlier Liferay DXP versions 7.0 through 7.0 before fix pack 90 Liferay DXP versions 7.1 through 7.1 before fix pack 17 Liferay DXP versions 7.2 through 7.2 before fix pack 5 Description: The issue concerns t...

The vulnerability of theutils.cfc component in the ColdFusion software platform allows attackers to execute arbitrary code.

The vulnerability of theutils.cfc component in the ColdFusion software platform allows unauthenticated attackers to execute arbitrary code by connecting to any LDAP server via the verifyldapserver parameter...

CentOS: Security Advisory for 389-ds-base (CESA-2022:0628)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openldap security update

CentOS Errata and Security Advisory CESA-2022:0621 An update for openldap is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server. Using this tool allows you get JNDI links, you ca...

Security Bulletin: IBM PowerVM Novalink could allow a remote authenticated attacker to conduct an LDAP injection.

Summary IBM PowerVM Novalink, which consumes IBM WebSphere Application Server Liberty 21.0.0.10, could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission ...

Adobe ColdFusion 11 Remote Code Execution Vulnerability

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html Version: Adobe...

Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Date: 2022-22-02 Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html...

Adobe ColdFusion 11 Remote Code Execution

Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution RCE Google Dork: intext:"adobe coldfusion 11" Date: 2022-22-02 Exploit Author: Amel BOUZIANE-LEBLOND https://twitter.com/amellb Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html...

CVE-2022-0564

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

Authentication flaw

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

Security Bulletin: Security vulnerability in WebSphere Application Server Liberty shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2021-39031)

Summary IBM WebSphere Application Server Liberty is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. WebSphere Application Server Liberty is vulnerable to LDAP Injection. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2022-0564 Qlik Sense Enterprise Domain User enumeration

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time...

PT-2022-13264 · Qlik · Qlik Sense Enterprise

Name of the Vulnerable Software and Affected Versions: Qlik Sense Enterprise on Windows affected versions not specified Description: A vulnerability in Qlik Sense Enterprise on Windows could allow a remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by...

CVE-2022-0564

CVE-2022-0564 affects Qlik Sense Enterprise on Windows. The vulnerability exists in the /internal_forms_authentication/ endpoint and enables an unauthenticated/remote attacker to enumerate domain user accounts by measuring response times, conditioned on LDAP being configured. Impact is informatio...