CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2013-4485 – 389-ds-base: DoS due to improper handling of ger attr searches
https://notcve.org/view.php?id=CVE-2013-4485
21 Nov 2013 — 389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request. 389 Directory Server 1.2.11.15 (también conocido como Red Hat Directory Server anterior a la versión 8.2.11-14) permite a usuarios remotos autenticados provocar una denegación de servicio (caída) a través de múltiples caracteres @ en una lista de atributo GER de una petición de búsqueda. Th... • http://rhn.redhat.com/errata/RHSA-2013-1752.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-2219 – Server: ACLs inoperative in some search scenarios
https://notcve.org/view.php?id=CVE-2013-2219
30 Jul 2013 — The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute. El Red Hat Directory Server 8.2.11-13 y 389 Directory Server, no restringe adecuadamente los atributos de entidad, lo que permite a usuarios autenticados remotamente obtener información sensible a través de una consulta de búsqueda hacia ese atributo. Red Hat Directory Server ... • http://rhn.redhat.com/errata/RHSA-2013-1116.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 42EXPL: 0CVE-2012-2678 – rhds/389: plaintext password disclosure flaw
https://notcve.org/view.php?id=CVE-2012-2678
03 Jul 2012 — 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute. "389 Directory Server" antes de v1.2.11.6 (también conocido como Red Hat Directory Server antes de v8.2.10-3), cuando la contraseña de un usuario de LDAP ha cambiado y anyes de que el servidor haya sido reiniciado, permite a atacantes remot... • http://directory.fedoraproject.org/wiki/Release_Notes • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 0%CPEs: 42EXPL: 0CVE-2012-2746 – rhds/389: plaintext password disclosure in audit log
https://notcve.org/view.php?id=CVE-2012-2746
03 Jul 2012 — 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password. "389 Directory Server" antes de v1.2.11.6 (también conocido como Red Hat Directory Server antes de v8.2.10-3), cuando la contraseña de un usuario de LDAP ha cambiado y el registro de auditoría está habilitada, guarda la nueva contraseña... • http://directory.fedoraproject.org/wiki/Release_Notes • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 23%CPEs: 6EXPL: 0CVE-2008-2928 – Server: CGI accept language buffer overflow
https://notcve.org/view.php?id=CVE-2008-2928
29 Aug 2008 — Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header. Múltiples desbordamiento de búfer en la biblioteca adminutil de aplicaciones CGI en Red Hat Directory Server 7.1 anteriores a SP7, permiten a atacantes remotos provocar una denegación de servicio (caída de demonio) o posiblemente ejecución arbitraria de... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2008-2929 – Server: multiple XSS issues
https://notcve.org/view.php?id=CVE-2008-2929
29 Aug 2008 — Multiple cross-site scripting (XSS) vulnerabilities in the adminutil library in the Directory Server Administration Express and Directory Server Gateway (DSGW) web interface in Red Hat Directory Server 7.1 before SP7 and 8 EL4 and EL5, and Fedora Directory Server, allow remote attackers to inject arbitrary web script or HTML via input values that use % (percent) escaping. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la biblioteca adminutil del interface web de Directory S... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 14%CPEs: 8EXPL: 1CVE-2008-2930 – RedHat 8/9 - Directory Server Crafted Search Pattern Denial of Service
https://notcve.org/view.php?id=CVE-2008-2930
29 Aug 2008 — Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem. Red Hat Directory Server 7.1 anteriores al SP7, Red Hat Directory Server 8, y Fedora Directory Server 1.1.1 permiten a atacantes remotos provocar una denegación de servicio (consumo de CPU y agotamiento de búsqueda... • https://www.exploit-db.com/exploits/32304 • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 7%CPEs: 8EXPL: 0CVE-2008-3283 – Server: multiple memory leaks
https://notcve.org/view.php?id=CVE-2008-3283
29 Aug 2008 — Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests. Múltiples fugas de memoria en Red Hat Directory Server 7.1 anteriores al SP7, Red Hat Directory Server 8, y Fedora Directory Server 1.1.1 y anteriores, permiten a atacantes remotos provocar una denegac... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 • CWE-399: Resource Management Errors CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 9.8EPSS: 3%CPEs: 7EXPL: 0CVE-2008-1677 – Server: insufficient buffer size for search patterns
https://notcve.org/view.php?id=CVE-2008-1677
12 May 2008 — Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service (slapd crash) and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression. Desbordamiento de búfer en el controlador de expresiones regulares de Red Hat Directory Server 8.0 y 7.1 anterior a SP6 permite a atacantes remotos provocar una denegación de servicio (caída de slapd) y posibleme... • http://secunia.com/advisories/30181 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 0CVE-2008-0892 – Server: shell command injection in CGI replication monitor
https://notcve.org/view.php?id=CVE-2008-0892
16 Apr 2008 — The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands. Las secuencias de comandos CGI Replication Monitor (monitor de duplicación) en Red Hat Administration Server, como lo usan Red Hat Directory Server 8.0 EL4 y EL5, permite a atacantes remotos ejecutar comandos de su elección. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01433676 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •