CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1854 – 389-ds-base: access control bypass with modrdn
https://notcve.org/view.php?id=CVE-2015-1854
19 Sep 2017 — 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. 389 Directory Server en versiones anteriores a la 1.3.3.10 permite que los atacantes omitan las restricciones de acceso previstas y modifiquen las entradas del directorio mediante una llamada ldapmodrdn manipulada. A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157069.html • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3230
https://notcve.org/view.php?id=CVE-2015-3230
29 Oct 2015 — 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher. 389 Directory Server (anteriormente Fedora Directory Server) en versiones anteriores a 1.3.3.12 no hace cumplir la preferencia nsSSL3Ciphers cuando crean un sslSocket, lo que permite a atacantes remotos tener un impacto no especificado mediante la petición de utilizar ... • http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html • CWE-254: 7PK - Security Features •
CVSS: 6.5EPSS: 0%CPEs: 44EXPL: 0CVE-2014-8112 – 389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off
https://notcve.org/view.php?id=CVE-2014-8112
05 Mar 2015 — 389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog. 389 Directory Server 1.3.1.x, 1.3.2.x anterior a 1.3.2.27, y 1.3.3.x anterior a 1.3.3.9 almacena contraseñas sin estar en hash incluso cuando la opción nsslapd-unhashed-pw-switch está configurado como apagado (off), lo que permite a usuarios... • http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2014-8105 – 389-ds-base: information disclosure through 'cn=changelog' subtree
https://notcve.org/view.php?id=CVE-2014-8105
05 Mar 2015 — 389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors. 389 Directory Server anterior a 1.3.2.27 y 1.3.3.x anterior a 1.3.3.9 no restringe correctamente acceso al subárbol LDAP 'cn=changelog', lo que permite a atacantes remotos obtener información sensible del registro de cambios (changelog) a través de vectores no especifica... • http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-2-27.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •