Show filters
12 Total Results
Displaying 1-10 of 12
Sort by:
Attacker Value
Unknown
CVE-2018-1089
Disclosure Date: May 09, 2018 (last updated November 26, 2024)
389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.
0
Attacker Value
Unknown
CVE-2017-7551
Disclosure Date: August 16, 2017 (last updated November 26, 2024)
389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
0
Attacker Value
Unknown
CVE-2016-0741
Disclosure Date: April 19, 2016 (last updated November 25, 2024)
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
0
Attacker Value
Unknown
CVE-2014-8112
Disclosure Date: March 10, 2015 (last updated October 05, 2023)
389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.
0
Attacker Value
Unknown
CVE-2014-8105
Disclosure Date: March 10, 2015 (last updated October 05, 2023)
389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.
0
Attacker Value
Unknown
CVE-2014-3562
Disclosure Date: August 21, 2014 (last updated October 05, 2023)
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.
0
Attacker Value
Unknown
CVE-2013-4283
Disclosure Date: September 10, 2013 (last updated October 05, 2023)
ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.
0
Attacker Value
Unknown
CVE-2013-1897
Disclosure Date: May 13, 2013 (last updated October 05, 2023)
The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
0
Attacker Value
Unknown
CVE-2004-0826
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
0
Attacker Value
Unknown
CVE-2004-0079
Disclosure Date: November 23, 2004 (last updated February 22, 2025)
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
0
