CWE-90 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-90/ Sun, 26 Feb 2023 06:50:26 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-90 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-90/ 32 32 CVE-2018-5730 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5730/ Sun, 26 Feb 2023 06:50:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5730/ MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a “linkdn” and “containerdn” database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within […]

The post CVE-2018-5730 appeared first on CVE Vulnerability.

]]> MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a “linkdn” and “containerdn” database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.

The post CVE-2018-5730 appeared first on CVE Vulnerability.

]]> CVE-2019-4297 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-4297/ Sun, 26 Feb 2023 06:33:22 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-4297/ IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.

The post CVE-2019-4297 appeared first on CVE Vulnerability.

]]> IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761.

The post CVE-2019-4297 appeared first on CVE Vulnerability.

]]> CVE-2021-41232 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-41232/ Thu, 23 Feb 2023 14:11:57 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-41232/ Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should […]

The post CVE-2021-41232 appeared first on CVE Vulnerability.

]]> Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.

The post CVE-2021-41232 appeared first on CVE Vulnerability.

]]> CVE-2021-32651 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-32651/ Thu, 23 Feb 2023 14:09:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-32651/ OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter […]

The post CVE-2021-32651 appeared first on CVE Vulnerability.

]]> OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2.

The post CVE-2021-32651 appeared first on CVE Vulnerability.

]]> CVE-2022-4254 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4254/ Thu, 23 Feb 2023 05:21:01 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4254/ sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

The post CVE-2022-4254 appeared first on CVE Vulnerability.

]]> sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

The post CVE-2022-4254 appeared first on CVE Vulnerability.

]]>