Approved changes feed: RSS · Atom

cpe:2.3:a:lemonldap-ng:lemonldap\:\:ng:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorLemonldap Ng (3c4c4df5-7197-5da2-99ed-078be3118e65)
ProductLemonldap::Ng (96c26869-4b76-507a-a1a7-c257709e7104)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-59518 vulnerable 2026-06-08 07:35:22.288435 Details available
HIGH (8)
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.
Published: 2025-09-17T00:00:00.000Z
Updated: 2026-05-11T08:38:41.992Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-48933 vulnerable 2026-06-08 06:50:11.732949 Details available
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters.
Published: 2024-10-09T00:00:00.000Z
Updated: 2025-11-03T22:22:05.046Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-44469 vulnerable 2026-06-08 06:12:41.069919 Details available
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
Published: 2023-09-29T00:00:00.000Z
Updated: 2024-09-23T16:32:58.941Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-28862 vulnerable 2026-06-08 06:02:36.557178 Details available
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.
Published: 2023-03-31T00:00:00.000Z
Updated: 2025-02-14T19:33:52.706Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-37186 vulnerable 2026-06-08 05:47:11.754477 Details available
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Published: 2023-04-16T00:00:00.000Z
Updated: 2025-02-06T18:50:51.917Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35472 vulnerable 2026-06-08 05:32:48.746657 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-24660 vulnerable 2026-06-08 05:22:35.277509 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-16093 vulnerable 2026-06-08 05:19:27.353731 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-19791 vulnerable 2026-06-08 05:13:23.707387 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-15941 vulnerable 2026-06-08 05:13:07.167314 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-6426 vulnerable 2026-06-08 05:03:00.072431 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.