Overview 26 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
26matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
4public PoC15.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
3.8%
Not applicable
25
96.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
26
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
4
15.4%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
22
84.6%
split by
peak 4 / year
20001
Not applicable1
Medium1
not blocked1
No public exploit1
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20020
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20041
Not applicable1
Medium1
not blocked1
No public exploit1
20050
20062
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20070
20083
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20101
Not applicable1
Medium1
not blocked1
No public exploit1
20114
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20121
Not applicable1
Medium1
not blocked1
No public exploit1
20130
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20154
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20160
20173
Outside Waratek scope1
Not applicable2
Medium3
not blocked3
No public exploit3
20180
20191
Not applicable1
Medium1
not blocked1
No public exploit1
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20002002200420062008201020122014201620182020
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-15719 | Medium | 2020-07-14 | Not applicable | No public exploit | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. |
| CVE-2019-13057 | Medium | 2019-07-26 | Not applicable | No public exploit | An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.) |
| CVE-2017-14159 | Medium | 2017-09-05 | Not applicable | No public exploit | slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript. |
| CVE-2016-4984 | Medium | 2017-07-17 | Not applicable | No public exploit | /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it. |
| CVE-2017-9287 | Medium | 2017-05-29 | Outside Waratek scope | No public exploit | servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0. |
| CVE-2015-6908 | Medium | 2015-09-11 | Not applicable | Working exploit published | The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. |
| CVE-2014-9713 | Medium | 2015-04-01 | Not applicable | No public exploit | The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors. |
| CVE-2015-1546 | Medium | 2015-02-12 | Not applicable | No public exploit | Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control. |
| CVE-2015-1545 | Medium | 2015-02-12 | Not applicable | No public exploit | The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request. |
| CVE-2013-4449 | Medium | 2014-02-05 | Not applicable | No public exploit | The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search. |
| CVE-2012-2668 | Medium | 2012-06-17 | Not applicable | No public exploit | libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information. |
| CVE-2011-4079 | Medium | 2011-10-27 | Not applicable | No public exploit | Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry. |
| CVE-2011-1081 | Medium | 2011-03-20 | Not applicable | Working exploit published | modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field. |
| CVE-2011-1025 | Medium | 2011-03-20 | Not applicable | No public exploit | bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password. |
| CVE-2011-1024 | Medium | 2011-03-20 | Not applicable | No public exploit | chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server. |
| CVE-2010-0212 | Medium | 2010-07-28 | Not applicable | No public exploit | OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite. |
| CVE-2009-3767 | Medium | 2009-10-23 | Not applicable | No public exploit | libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. |
| CVE-2008-2952 | Medium | 2008-07-01 | Not applicable | Working exploit published | liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. |
| CVE-2008-0658 | Medium | 2008-02-13 | Not applicable | No public exploit | slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39 allows remote authenticated users to cause a denial of service (daemon crash) via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION) control, a related issue to CVE-2007-6698. |
| CVE-2007-6698 | Medium | 2008-02-01 | Not applicable | No public exploit | The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical, possibly due to a double free vulnerability. |
| CVE-2006-6493 | Medium | 2006-12-13 | Not applicable | Working exploit published | Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data. |
| CVE-2006-2754 | Medium | 2006-06-01 | Not applicable | No public exploit | Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code via a long hostname. |
| CVE-2004-1880 | Medium | 2004-12-31 | Not applicable | No public exploit | Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service (memory consumption). |
| CVE-2003-1201 | Medium | 2003-03-20 | Not applicable | No public exploit | ldbm_back_exop_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slap_passwd_parse function does not return LDAP_SUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service (segmentation fault). |
| CVE-2001-0977 | Medium | 2001-07-16 | Not applicable | No public exploit | slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field. |
| CVE-2000-0748 | Medium | 2000-10-20 | Not applicable | No public exploit | OpenLDAP 1.2.11 and earlier improperly installs the ud binary with group write permissions, which could allow any user in that group to replace the binary with a Trojan horse. |