[SECURITY] Fedora 27 Update: curl-7.55.1-6.fc27

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

KLA11142 DoS and OSI vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware vCenter Server and vSphere Web Client. Malicious users can exploit these vulnerabilities to cause denial of service or disclose sensetive information. Below is a complete list of vulnerabilities: 1. An unspecified vulnerability in VMware...

CVE-2017-8028

A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with...

Joomla! Core LDAP Information Disclosure Vulnerability (Nov 2017)

Joomla is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...

VMSA-2017-0017:VMware vCenter Server update resolves LDAP DoS, SSRF and CRLF injection issues

VMSA-2017-0017 VMware vCenter Server update resolves LDAP DoS, SSRF and CRLF injection issues VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2017-0017 VMware Security Advisory Severity: Moderate VMware Security Advisory Synopsis: VMware vCenter Server update resolves LDAP DoS...

Apache ActiveMQ < 5.10.1 Multiple Security Vulnerabilities - Windows

Apache ActiveMQ is prone to multiple security vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:activemq";...

openSUSE Security Update : sssd (openSUSE-2017-1251)

This update for sssd provides the following fixes : Security issues fixed : - CVE-2017-12173: Fixed unsanitized input when searching in local cache database bsc1061832. Non security issues fixed : - Fixed a segfault issue in ldaprfc2307fallbacktolocalusers. bsc1055123 - Install /var/lib/sss/mc...

Active Directory Integration <= 1.1.8 - Authenticated SQL Injection

Type user acces: administrator user. Target need have configured ldap and active. Path Request: /wp-content/plugins/active-directory-integration/syncback.php Line : 135 $result = $ADI-bulksyncback $GET'userid' ; $GET‘userid’ is not escaped. Path Method:...

A Managed Password Cracking Tool: GoCrack

FireEye’s Innovation and Custom Engineering ICE team released a tool called GoCrack that allows red teams to efficiently manage password cracking tasks across multiple GPU servers by providing an easy-to-use, web-based real-time UI to create, view, and manage tasks. Simply deploy a GoCrack server...

Introducing GoCrack: A Managed Password Cracking Tool

FireEye's Innovation and Custom Engineering ICE team released a tool today called GoCrack that allows red teams to efficiently manage password cracking tasks across multiple GPU servers by providing an easy-to-use, web-based real-time UI Figure 1 shows the dashboard to create, view, and manage...

Authentication Bypass

spring-ldap-core is vulnerable to authentication bypass. If no additional attributes are bound when connecting to a LDAP server which uses BindAuthenticator with the DefaultTlsDirContextAuthenticationStrategy strategy, an attacker can set userSearch and pass a valid username with an arbitrary...

openSUSE Security Update : cacti and cacti-spine (openSUSE-2017-1173)

This update for cacti and cacti-spine fixes the following issues : Build version 1.1.26 - issue841: --input-fields variable not working with addgraphs.php cli - issue986: Resolve minor appearance problem on Modern theme - issue989: Resolve issue with data input method commands loosing spaces on...

openSUSE Security Update : krb5 (openSUSE-2017-1145)

This update for krb5 fixes several issues. This security issue was fixed : - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995 These non-security issues were fixed : - Set 'rdns' and 'dnscanonicalizehostname' to false in krb5.conf in order to improve...

Backend SSL Connection Fails on ADC due to missing extensions

When using Secure-LDAP which uses port 636 TCPs or while making connection to server listening on secure port,it fails in SSL handshake phase...

Authentication flaw

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory...

CVE-2015-5246

Technical details about CVE-2015-5246 are not publicly available in the provided connected documents. The sources summarize an LDAP authentication issue in Foreman but do not specify affected versions, exploit methods, or fixes. Monitor for updates.

[20171101] - Core - LDAP Information Disclosure

Inadequate escaping in the LDAP authentication plugin can result in disclosure of username and password...

Login With Empty Credential

github.com/go-ldap/ldap allows the user to login with empty password or credentials. The vulnerability is only affects applications with the following conditions: - authorization of a user is performed by relying on the return error of the Bind function call i.e., a nil return is considered...