CVE-2024-37393

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

• CWE-319
• CWE-89

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22Exploit
• https://securenvoy.com/support/Product
• https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393Exploit, Third Party Advisory
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/ad2ce8fa-42a0-4371-ad18-5d1d1c488b22Exploit
• https://securenvoy.com/support/Product
• https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393Exploit, Third Party Advisory

Published

Jun 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37387Use of potentially dangerous function issue exists in Ricoh …4
• CVE-2024-37388An XML External Entity (XXE) vulnerability in the ebookmeta.…9.1
• CVE-2024-37389Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0…5.4
• CVE-2024-3739A vulnerability classified as critical was found in cym1102 …9.8
• CVE-2024-37391ProtonVPN before 3.2.10 on Windows mishandles the drive inst…7.8
• CVE-2024-37392A stored Cross-Site Scripting (XSS) vulnerability has been i…6.1
• CVE-2024-37394A stored cross-site scripting (XSS) vulnerability in the Pro…5.4
• CVE-2024-37395A stored cross-site scripting (XSS) vulnerability in the Pub…5.4
• CVE-2024-37396A stored cross-site scripting (XSS) vulnerability in the Cal…5.4
• CVE-2024-37397An External XML Entity (XXE) vulnerability in the provisioni…8.2
• CVE-2024-37398Insufficient validation in Ivanti Secure Access Client befor…7.8
• CVE-2024-37399A NULL pointer dereference in WLAvalancheService in Ivanti A…7.5