CWE-90: LDAP Injection
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Also known as Improper Neutralization of Special Elements used in an LDAP Query.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- pac4jLDAP Injection in PAC4J8.7 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.java5.5 Medium
- mitmproxyProxyAuth Addon LDAP Injection in mitmproxy4.8 Medium
- foxcpp maddyMaddy Mail Server: LDAP Filter Injection via Unsanitized Username8.2 High
- mispLDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable8.8 High
- opnsense, opnsense core +1 moreOPNsense has an LDAP Injection via Unsanitized Username in Authentication8.2 High
- seppmail secure email gatewayPGP Decryption Sender LDAP Injection6.3 Medium
- seppmail secure email gatewayPGP Decryption Recipient LDAP Injection4.9 Medium
- dovecot, open-xchange gmbh ox dovecot pro +1 moreIf auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP...3.7 Low
- n8nn8n Vulnerable to LDAP Filter Injection in LDAP Node6.3 Medium
- suitecrmSuiterCRM has LDAP Filter Injection in Authentication Module8.8 High
- parse-community parse-serverParse Server has an LDAP injection via unsanitized user input in DN and group filter construction6.0 Medium
- wekanWeKan < 8.19 LDAP Authentication Filter Injection8.7 High
- watchguard fireware osWatchGuard Firebox LDAP Injection7.0 High
- arksine moonrakerMoonraker with LDAP Enabled Allows Malicious Search Filter Injection2.7 Low
- kanboardKanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure5.3 Medium
- homarrHomarr: missing input sanitization and possible privilege escalation through ldap search query injection7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.7.5 High
- cisa thoriumCISA Thorium LDAP injection5.3 Medium
- apache hertzbeat, apache software foundation hertzbeat (incubating) +1 moreApache HertzBeat (incubating): Jmx JNDI injection vulnerability8.8 High
- espocrmEspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements6.5 Medium
- mattermost, mattermost server +1 moreLDAP Injection in Mattermost Enterprise Edition When Using Active Directory4.1 Medium
- dell unisphere for powermaxDell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to...2.7 Low
- hitachi energy trmtrackerThe TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an...6.5 Medium
- sismics teedyWhen LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of...9.8 Critical
- siemens mendix ldapA vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of...9.1 Critical
- manageengine adselfservice plus, zohocorp manageengine adselfservice plus +1 moreDOS Vulnerability5.3 Medium
- linqiAn issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.9.8 Critical
- apache zeppelinApache Zeppelin: LDAP search filter query Injection Vulnerability6.5 Medium
- ibm operational decision managerIBM Operational Decision Manager JDNI injection8.1 High
- glpi-project glpiGLPI LDAP Injection during authentication5.9 Medium
- nvidia dgx a100, dgx a100 firmware +1 moreCVE6.5 Medium
- open-xchange ox app suiteThe optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter...7.6 High
- jahastech nxfilterJahastech NxFilter Bind Request ldap injection4.3 Medium
- red hat single sign-on 7Keycloak: ldap injection on username input7.5 High
- cyberlord92 active directory integration / ldap integration, miniorange active directory integration \/ ldap integration +1 moreActive Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection7.6 High
- joinmastodon mastodonMastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database7.7 High
- fedoraproject sssd, redhat enterprise linux, enterprise linux desktop +10 more +12 moresssd: libsss_certmap fails to sanitise certificate data used in LDAP filters8.8 High
- hydrian ttrss-auth-ldap, ttrrs-auth-ldap project ttrrs-auth-ldap +1 morehydrian TTRSS-Auth-LDAP Username ldap injection5.5 Medium
- apache manifoldcfApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities5.3 Medium
- enalean tuleapIndirect LDAP injection in Tuleap6.7 Medium
- enalean tuleapIndirect LDAP injection in Tuleap6.7 Medium
- apache traffic controlLDAP filter injection vulnerability in Traffic Ops9.8 Critical
- thunderdome planning poker, stevenweathers thunderdome-planning-poker +1 moreImproper Neutralization of Special Elements used in an LDAP Query8.1 High
- onedev project onedevLDAP injection via OneDev may leak some LDAP directory information3.1 Low
- is-user-valid project is-user-validLDAP Injection7.5 High
- traccarLDAP injection vulnerability in Traccar GPS Tracking System7.7 High
- cesnet perunLDAP connector injection in Perun6.2 Medium
- cloud foundry cf deployment, cf nfs volume release, cloudfoundry cf-deployment +1 more +3 moreVolume Services is vulnerable to an LDAP injection attack8.4 High
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated...6.4 Medium
- Show moreLoading…