DEBIAN-CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...

PT-2015-2724 · Apache · Apache Activemq

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions 5.x through 5.10.0 Description: The issue is related to the implementation of LDAPLoginModule and components of the Java Authentication and Authorization Service in Apache ActiveMQ, which has weaknesses in its...

Authentication flaw

The userldap aka LDAP user and group backend application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind...

Authentication flaw

Apache CloudStack 4.3.x before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to bypass authentication via a login request without a password, which triggers an unauthenticated bind...

DEBIAN-CVE-2014-8763

DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null \0 character and a valid user name, which triggers an unauthenticated bind...

CVE-2014-6387

gpcapi.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind...

UBUNTU-CVE-2014-8088

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind...

Authentication flaw

gpcapi.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind...

CVE-2014-8088

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind...

CVE-2014-8763

DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null \0 character and a valid user name, which triggers an unauthenticated bind...

CVE-2014-0074

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty 1 username or 2 password...

DEBIAN-CVE-2014-0074

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty 1 username or 2 password...

CVE-2003-1434

The CVE concerns login_ldap 3.1 and 3.2, where remote attackers can initiate unauthenticated binds if (a) bind_anon_dn is on (bind with no password), (b) bind_anon_cred is on (bind with no DN), or (c) bind_anon is on (bind with no DN or password). Root cause is misconfiguration allowing unauthent...

CVE-2003-1434

loginldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if 1 bindanondn is on, which allows a bind with no password provided, 2 bindanoncred is on, which allows a bind with no DN, or 3 bindanon is on, which allows a bind with no DN or password...

CVE-2003-1434

loginldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if 1 bindanondn is on, which allows a bind with no password provided, 2 bindanoncred is on, which allows a bind with no DN, or 3 bindanon is on, which allows a bind with no DN or password...