#cwe-90

共收录 39 条相关情报。

漏洞预警2026-08-14 发布MEDIUM

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the sy...

CVE-2026-74241

Red Hat Quay 的外部 LDAP 认证处理中发现一个安全缺陷 (CVE-2026-74241)。该缺陷源于系统在 LDAP 认证过程中遇到 referral（引用）时，未能正确转义用户名输入。具体而言，当认证请求触发 LDAP r

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

安全公告2026-08-14 发布INFO

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

CVE-2026-53658

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP ui

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-90 #severity:medium

安全公告2026-08-03 发布INFO

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-90 #severity:medium

漏洞预警2026-08-03 发布INFO

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

安全公告2026-08-03 发布INFO

LDAP filter injection in legacy jdk1.4 LDAPStoreHelper

CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-90

漏洞预警2026-07-31 发布INFO

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Bec...

CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the Cle

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-07-14 发布HIGH

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-47303

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over

来源摘录 · NVD

#cve #cwe-302 #cwe-863 #cwe-90

漏洞预警2026-07-09 发布INFO

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects ...

CVE-2026-4256

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-07-07 发布INFO

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MY...

CVE-2026-13696

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Lima

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-06-24 发布INFO

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowin...

CVE-2026-57288

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-06-22 发布INFO

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an ...

CVE-2026-11748

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstAct

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

安全公告2026-06-19 发布INFO

OpenBao: LDAPi ldaputil (wrong escape func)

CVE-2026-55770

## 1. Description ### Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDA

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-90 #severity:medium

安全公告2026-06-17 发布INFO

A remote attacker can inject LDAP special characters into the Distinguished Name (DN)...

CVE-2026-49268

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-90 #severity:high

漏洞预警2026-06-10 发布INFO

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search...

CVE-2026-42568

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `or

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

安全公告2026-05-26 发布INFO

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

CVE-2026-42568

### Summary An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filt

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-90 #severity:medium

漏洞预警2026-05-21 发布INFO

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP e...

CVE-2026-44063

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDA

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-05-19 发布INFO

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are...

CVE-2026-41919

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. Thi

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-05-14 发布INFO

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementati...

CVE-2026-44671

ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was di

历史摘要 · 未重新核验 · NVD

#cve #cwe-90

漏洞预警2026-05-12 发布INFO

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via P...

CVE-2026-44304

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) construc

历史摘要 · 未重新核验 · NVD

#cve #cwe-90