Design/Logic Flaw

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

CVE-2015-4288

The LDAP implementation on the Cisco Web Security Appliance WSA 8.5.0-000, Email Security Appliance ESA 8.5.7-042, and Content Security Management Appliance SMA 8.3.6-048 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain...

ipa security and bug fix update

3.0.0-47.el6 - Resolves: 1220788 - Some IPA schema files are not RFC 4512 compliant 3.0.0-46.el6 - Use tls version range in NSSHTTPS initialization - Resolves: 1154687 - POODLE: force using safe ciphers non-SSLv3 in IPA client and server - Resolves: 1012224 - host certificate not issued to client...

CentOS 6 : curl (CESA-2015:1254)

Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

sudo security, bug fix, and enhancement update

1.8.6p3-19 - RHEL-6.7 erratum - modified the authlogicfix patch to fix 1144448 - fixed a bug in the ldapusermatchfix patch Resolves: rhbz1144448 Resolves: rhbz1142122 1.8.6p3-18 - RHEL-6.7 erratum - fixed the mantypos-ldap.patch Resolves: rhbz1138267 1.8.6p3-17 - RHEL-6.7 erratum - added patch fo...

ipa security update

CentOS Errata and Security Advisory CESA-2015:1462 Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base...

curl, libcurl security update

CentOS Errata and Security Advisory CESA-2015:1254 Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common...

Multiple Cisco Products LDAP Server SSL Certificate Validation Vulnerability

A vulnerability in SSL certificate validation of multiple Cisco products could allow an unauthenticated, remote attacker to stage a man-in-the-middle attack. The vulnerability is due to lack of SSL certificate validation for secure LDAP. An attacker could exploit this vulnerability to stage a...

Device management authentication bypass

Devices running PAN-OS 7.0.0 including Panorama that are configured to use LDAP for captive portal or device management authentication do not properly perform authentication against the LDAP server in specific cases, leading to an authentication bypass. There is no issue if you are using Radius o...

RedHat Update for ipa RHSA-2015:1462-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : ipa (RHSA-2015:1462)

Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Fedora 21 : php-horde-Horde-Auth-2.1.10-1.fc21 / php-horde-Horde-Core-2.20.6-1.fc21 / etc (2015-11287)

HordeForm 2.0.10 - jan SECURITY: Fixed XSS in form renderer. HordeIcalendar 2.1.1 - jan Fix generated VALARM TRIGGER attributes with empty duration Ralf Becker. HordeAuth 2.1.10 - jan SECURITY: Don't allow to login to LDAP with an emtpy password. HordeCore 2.20.6 - jan SECURITY: Don't allow to...

Fedora 22 : php-horde-Horde-Auth-2.1.10-1.fc22 / php-horde-Horde-Core-2.20.6-1.fc22 / etc (2015-11261)

HordeForm 2.0.10 - jan SECURITY: Fixed XSS in form renderer. HordeIcalendar 2.1.1 - jan Fix generated VALARM TRIGGER attributes with empty duration Ralf Becker. HordeAuth 2.1.10 - jan SECURITY: Don't allow to login to LDAP with an emtpy password. HordeCore 2.20.6 - jan SECURITY: Don't allow to...

RHEL 6 : curl (RHSA-2015:1254)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1254 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

Fortinet FortiAnalyzer 5.0.x < 5.0.3 LDAP Authentication Bypass

The version of Fortinet FortiAnalyzer running on the remote host is 5.0.x prior to 5.0.3. It is, therefore, potentially affected by an authentication bypass vulnerability that allows an LDAP user to authenticate without entering a password when LDAP is configured and enabled. Note that Nessus has...

Moderate: Red Hat Security Advisory: ipa security and bug fix update

Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Moderate: Red Hat Security Advisory: curl security, bug fix, and enhancement update

Updated curl packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

REST API Vulnerability in Multiple F5 BIG-IQ Products

The BIG-IQ Cloud Platform provides the core services necessary for the management of application-oriented services. A security vulnerability exists in the REST API of multiple F5 BIG-IQ products, which can be exploited by a remote attacker to obtain an authentication token for any user by guessin...

CVE-2015-4637

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing...

Authentication flaw

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing...