TI-2023-13366 CVE-2023-28862 · GHSA-r74q-xwhp-q6r9
An issue was discovered in LemonLDAP::NG before 2.16.1.
Priority HIGH 82
An issue was discovered in LemonLDAP::NG before 2.16.1.
lemonldap-ng
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9
Exploited now
lemonldap-ng records in CISA KEVNo lemonldap-ng vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records in Lemonldap · all components
TI-2024-32628 CVE-2024-48933 · GHSA-vp6w-3fx2-4f2w
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote…
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default val…
TI-2022-17335 CVE-2022-37186 · GHSA-x33x-q828-vc8w
In LemonLDAP::NG before 2.0.15.
Priority MEDIUM 60
In LemonLDAP::NG before 2.0.15.
TI-2023-23963 CVE-2023-44469 · GHSA-fmg2-2hq5-5jxf
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before…
Priority MEDIUM 53
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter…
TI-2019-14263 CVE-2019-19791 · GHSA-c639-6g37-r8wm
In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server…
Priority MEDIUM 50
In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used).
TI-2019-09012 CVE-2019-12046 · GHSA-2gh8-gx83-42h9
LemonLDAP::NG -2.0.3 has Incorrect Access Control.
Priority MEDIUM 48
LemonLDAP::NG -2.0.3 has Incorrect Access Control.
TI-2020-15127 CVE-2020-24660 · GHSA-x44x-r84w-8v67
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.
Priority MEDIUM 47
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.
TI-2019-11985 CVE-2019-15941 · GHSA-jq88-5p5w-x8c3
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass…
Priority MEDIUM 47
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request.
TI-2021-17795 CVE-2021-40874 · GHSA-gvrq-49rv-2rq7
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13.
Priority MEDIUM 44
An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13.
TI-2021-14213 CVE-2021-35472 · GHSA-9v87-664x-72qc
An issue was discovered in LemonLDAP::NG before 2.0.12.
Priority MEDIUM 42
An issue was discovered in LemonLDAP::NG before 2.0.12.
TI-2019-09764 CVE-2019-13031 · GHSA-wxgq-mv23-pgqr
LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a…
Priority MEDIUM 40
LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server.
TI-2012-05173 CVE-2012-6426 · GHSA-9q8m-r734-6gg5
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the…
Priority LOW 36
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.
TI-2020-12663 CVE-2020-16093 · GHSA-9c48-27fx-7952
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is…
Priority LOW 34
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl…