Lemonldap::Ng
Approved changes feed: RSS · Atom
cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Lemonldap Ng (3c4c4df5-7197-5da2-99ed-078be3118e65) |
|---|---|
| Product | Lemonldap::Ng (96c26869-4b76-507a-a1a7-c257709e7104) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-59518 |
vulnerable | 2026-06-08 07:35:22.288435 |
Details available
HIGH (8)
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.
Published: 2025-09-17T00:00:00.000Z
Updated: 2026-05-11T08:38:41.992Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-48933 |
vulnerable | 2026-06-08 06:50:11.732949 |
Details available
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.
Published: 2024-10-09T00:00:00.000Z
Updated: 2025-11-03T22:22:05.046Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-44469 |
vulnerable | 2026-06-08 06:12:41.069919 |
Details available
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
Published: 2023-09-29T00:00:00.000Z
Updated: 2024-09-23T16:32:58.941Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28862 |
vulnerable | 2026-06-08 06:02:36.557178 |
Details available
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.
Published: 2023-03-31T00:00:00.000Z
Updated: 2025-02-14T19:33:52.706Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-37186 |
vulnerable | 2026-06-08 05:47:11.754477 |
Details available
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Published: 2023-04-16T00:00:00.000Z
Updated: 2025-02-06T18:50:51.917Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-35472 |
vulnerable | 2026-06-08 05:32:48.746657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24660 |
vulnerable | 2026-06-08 05:22:35.277509 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16093 |
vulnerable | 2026-06-08 05:19:27.353731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19791 |
vulnerable | 2026-06-08 05:13:23.707387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-15941 |
vulnerable | 2026-06-08 05:13:07.167314 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-6426 |
vulnerable | 2026-06-08 05:03:00.072431 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.