CVSS: 4.0EPSS: 0%CPEs: 42EXPL: 0CVE-2012-2678 – rhds/389: plaintext password disclosure flaw
https://notcve.org/view.php?id=CVE-2012-2678
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute. "389 Directory Server" antes de v1.2.11.6 (también conocido como Red Hat Directory Server antes de v8.2.10-3), cuando la contraseña de un usuario de LDAP ha cambiado y anyes de que el servidor haya sido reiniciado, permite a atacantes remotos leer contraseñas en claro a través del atributo unhashed#user#password. • http://directory.fedoraproject.org/wiki/Release_Notes http://osvdb.org/83336 http://rhn.redhat.com/errata/RHSA-2012-0997.html http://rhn.redhat.com/errata/RHSA-2012-1041.html http://secunia.com/advisories/49734 http://www.securityfocus.com/bid/54153 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19353 https://access.redhat.com/security/cve/CVE-2012-267 • CWE-310: Cryptographic Issues •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3282
https://notcve.org/view.php?id=CVE-2010-3282
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log. 389 Directory Server versiones anteriores a 1.2.7.1 (también se conoce como Red Hat Directory Server versión 8.2) y HP-UX Directory Server versiones anteriores a B.08.10.03, cuando el registro de auditoría está habilitado, registra la contraseña de Directory Manager (nsslapd-rootpw) en texto sin cifrar cuando se cambia cn=config:nsslapd-rootpw, que podría permitir a usuarios locales obtener información confidencial mediante la lectura del registro. • http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914 https://bugzilla.redhat.com/show_bug.cgi?id=625950 https://git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c02522633&docLocale=en_US • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2241 – redhat-ds: setup script insecure .inf file permissions
https://notcve.org/view.php?id=CVE-2010-2241
The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts. Los scripts de configuración (1) setup-ds.pl y (2) setup-ds-admin.pl para Red Hat Directory Server v8 anterior a v8.2 usa permisos de lectura para todos "world-readable" cuando crea ficheros de cache, lo cual permite a usuarios locales obtener información sensible incluyendo contraseñas de cuentas administrativas de Directory y Administration Server. • http://rhn.redhat.com/errata/RHSA-2010-0590.html http://secunia.com/advisories/40811 http://www.osvdb.org/66962 http://www.securitytracker.com/id?1024281 https://bugzilla.redhat.com/show_bug.cgi?id=608032 https://access.redhat.com/security/cve/CVE-2010-2241 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 9%CPEs: 8EXPL: 1CVE-2008-2930 – RedHat 8/9 - Directory Server Crafted Search Pattern Denial of Service
https://notcve.org/view.php?id=CVE-2008-2930
Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem. Red Hat Directory Server 7.1 anteriores al SP7, Red Hat Directory Server 8, y Fedora Directory Server 1.1.1 permiten a atacantes remotos provocar una denegación de servicio (consumo de CPU y agotamiento de búsqueda) a través de una petición de búsqueda LDAP manipulada con patrones, relativos a los subsistemas de hilo-simple y expresión-regular. • https://www.exploit-db.com/exploits/32304 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 http://secunia.com/advisories/31565 http://secunia.com/advisories/31627 http://secunia.com/advisories/31702 http://secunia.com/advisories/31867 http://securitytracker.com/id?1020773 http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html http://www.redhat.com/support/errata/RHSA-2008-0602.html http://www.redhat.com/support/errata/RHSA& • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2008-2929 – Server: multiple XSS issues
https://notcve.org/view.php?id=CVE-2008-2929
Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la biblioteca adminutil del interface web de Directory Server Administration Express y Directory Server Gateway (DSGW) en Red Hat Directory Server 7.1 anteriores al SP7 y 8 EL4 y EL5, y Fedora Directory Server, permite a atacantes remotos inyectar web script o HTML de su elección a través de valores de entrada que utilizan el carácter de escape %. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 http://secunia.com/advisories/31565 http://secunia.com/advisories/31612 http://secunia.com/advisories/31702 http://secunia.com/advisories/31777 http://securitytracker.com/id?1020772 http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html http://www.securityfocus.com/bid/30870 http://www.vupen.com/english/advisories/2008/2480 https://bugzilla.redhat.com/show_bug.cgi?id=454621 ht • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •