Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 78

Export CSV
CVE-2021-3652

389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Port389 Redhat
Products
389-ds-base Directory Server Enterprise Linux and 1 more
CVE-2010-2241

redhat-ds: setup script insecure .inf file permissions

The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Directory Server
CVE-2013-2219

Server: ACLs inoperative in some search scenarios

The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.

CVSS 2.0 · 4.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server Enterprise Linux
CVE-2012-2678

rhds/389: plaintext password disclosure flaw

389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server Enterprise Linux
CVE-2012-0833

389: denial of service when using certificate groups

The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.

CVSS 2.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server Enterprise Linux
CVE-2011-0532

Server: use of insecure LD_LIBRARY_PATH settings

The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server
CVE-2011-0022

Server: insecure pid file directory permissions

The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service (daemon outage or arbitrary process termination) by replacing PID files contained in this directory.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server
CVE-2011-0019

Server: crash with multiple simple paged result searches

slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or dirsrv) does not properly handle simple paged result searches, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via multiple search requests.

CVSS 2.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server
CVE-2013-4485

389-ds-base: DoS due to improper handling of ger attr searches

389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server Enterprise Linux
CVE-2012-2746

rhds/389: plaintext password disclosure in audit log

389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.

CVSS 2.0 · 2.1 Low EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Directory Server Enterprise Linux
CVE-2023-1055

RHDS: LDAP browser tries to decode userPassword instead of userCertificate attribute

A flaw was found in RHDS 11 and RHDS 12. While browsing entries LDAP tries to decode the userPassword attribute instead of the userCertificate attribute which could lead into sensitive information leaked. An attacker with a local account where the cockpit-389-ds is running can list the processes and display the hashed passwords. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Directory Server
CVE-2019-14907

samba: Crash after failed character conversion at log level 3 or above

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2022-1949

389-ds-base: access control bypass by query (filter in LDAP terms) optimiser

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora 389 Directory Server Directory Server and 1 more
CVE-2021-3514

389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control()

When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
389 Directory Server Directory Server Enterprise Linux and 1 more
CVE-2020-35518

389-ds-base: information disclosure during the binding of a DN

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
389 Directory Server Directory Server Enterprise Linux and 1 more
CVE-2010-3282

RHDS/389: information disclosure in audit logs

389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Hp Redhat
Products
389 Directory Server Hp-ux Directory Server Directory Server and 1 more
CVE-2010-2222

redhat-ds/389: null deref in _ger_parse_control() for subjectdn can crash server

The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
389 Directory Server Directory Server