Threats Tagged 'cwe-90'
View all threats tagged with 'cwe-90'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cwe-90'
Click on any threat for detailed analysis and mitigation recommendations
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. (CVE-2026-74241)CVE-2026-74241 0 A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments. Join the discussion | GCVE Database | 08/15/2026, 00:31:24 UTC Added: 08/15/2026, 05:15:18 UTC |
CVE-2026-59652: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Legion of the Bouncy Castle Inc. BC-JAVACVE-2026-59652 0 CVE-2026-59652 is an LDAP injection vulnerability in the Bouncy Castle for Java library (BC-JAVA) affecting versions before 1.85. The issue occurs in the legacy jdk1.4 LDAPStoreHelper component, where improper neutralization of special elements in LDAP queries allows injection. This vulnerability has a medium severity with a CVSS score of 6.9. Join the discussion | CVE Database V5 | 08/03/2026, 00:39:23 UTC Added: 08/03/2026, 01:03:47 UTC |
CVE-2026-11770: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Red Hat Red Hat Directory Server 11CVE-2026-11770 0 A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information. Join the discussion | GCVE Database | 07/31/2026, 09:18:58 UTC Added: 07/31/2026, 15:37:32 UTC |
CVE-2026-44617: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Apache Software Foundation Apache ZeppelinCVE-2026-44617 0 Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 contain an LDAP injection vulnerability due to improper escaping of special characters in LDAP search filters. This vulnerability is an incomplete fix of a previous issue (CVE-2024-31867). The issue is resolved in version 0.12.1. The CVSS score is 6.5, indicating a medium severity risk. Join the discussion | CVE Database V5 | 07/30/2026, 15:22:39 UTC Added: 07/30/2026, 21:00:42 UTC |
CVE-2026-44616: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Apache Software Foundation Apache ZeppelinCVE-2026-44616 0 Apache Zeppelin versions 0.6.0 through 0.12.0 contain an LDAP injection vulnerability in the ActiveDirectoryGroupRealm component. This flaw allows an authenticated attacker to inject LDAP filter syntax via the user-search endpoint and potentially expose directory information. The role-lookup path is also affected after successful LDAP authentication. The issue is fixed in version 0.12.1. Join the discussion | CVE Database V5 | 07/30/2026, 15:21:21 UTC Added: 07/30/2026, 16:22:57 UTC |
Showing 1 to 5 of 5 results