CVE-2024-48933
Published Oct 9, 2024A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if user…
Vendor/product archive
lemonldap-ng / lemonldap::ng CVEs
Beta · best-effort12 CVEs tagged to lemonldap-ng / lemonldap::ng — 6 Critical, 3 High, 3 Medium, 0 Low, 0 Unrated.
CVE-2023-44469
Published Sep 29, 2023A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs throug…
CVE-2019-19791
Published May 29, 2023In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG se…
CVE-2022-37186
Published Apr 16, 2023In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least…
CVE-2023-28862
Published Mar 31, 2023An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers…
CVE-2021-40874
Published Jul 18, 2022An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST password validation service (for another LemonLDAP::NG inst…
CVE-2020-16093
Published Jul 18, 2022In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configu…
CVE-2021-35472
Published Jul 30, 2021An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication att…
CVE-2020-24660
Published Sep 14, 2020An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normaliz…
CVE-2019-15941
Published Sep 25, 2019OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable,…
CVE-2019-12046
Published May 22, 2019LemonLDAP::NG -2.0.3 has Incorrect Access Control.
CVE-2012-6426
Published Jan 1, 2013LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions vi…
Showing 1-12 of 12 CVEsPage 1 of 1