lemonldap-ng vulnerabilities (Debian)
25 vulnerabilities.
-
lemonldap-ngDebian Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restric… 6.5 Medium -
lemonldap-ngDebian Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify… 9.1 Critical -
lemonldap-ngDebian Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not ve… 9.1 Critical -
lemonldap-ngDebian Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO sessio… 9.8 Critical -
lemonldap-ngDebian lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect 5.3 Medium -
lemonldap-ngDebian In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can... 8.0 High -
lemonldap-ngDebian In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers... 7.2 High -
lemonldap-ngDebian A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers... 6.1 Medium -
lemonldap-ngDebian An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh... 8.8 High -
lemonldap-ngDebian An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in... 9.1 Critical -
lemonldap-ngDebian A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers... 6.1 Medium -
lemonldap-ngDebian Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers... 9.1 Critical -
lemonldap-ngDebian A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1... 4.3 Medium -
lemonldap-ngDebian In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration... 9.8 Critical -
lemonldap-ngDebian An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the... 9.8 Critical -
lemonldap-ngDebian In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be... 5.9 Medium -
lemonldap-ngDebian An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer... 9.8 Critical -
lemonldap-ngDebian In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not... 7.5 High -
lemonldap-ngDebian An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to... 8.8 High -
lemonldap-ngDebian Lack of URL normalization may lead to authorization bypass when URL access rules are used 9.8 Critical -
lemonldap-ngDebian OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access... 9.8 Critical -
lemonldap-ngDebian LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification... 8.1 High -
lemonldap-ngDebian LemonLDAP::NG -2.0.3 has Incorrect Access Control. 9.8 Critical -
lemonldap-ngDebian LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso... 7.5 High -
lemonldap-ngDebian [CSRF on 2FA registration] No score