LE
Vendor
lemonldap-ng
19
CVEs
0
On KEV
0
New 30D
Products
LE9.8
lemonldap-ng
lemonldap-ng
14 CVEs0 on KEV0 new
LE8.1
Lemonldap::
Lemonldap-ng
2 CVEs0 on KEV0 new
AP8.1
Apache::session::browsable
Lemonldap-ng
1 CVEs0 on KEV0 new
AP8.1
Apache::session::ldap
Lemonldap-ng
1 CVEs0 on KEV0 new
LH9.8
Lemonldap::ng Handler
Lemonldap-ng
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-12804 | LE lemonldap-ng Lemonldap-ng | 4.3 | Jun 21 | lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect |
| CVE-2025-31510 | LE LemonLDAP::NG lemonldap-ng | 7.2 | Jan 16 | In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab… |
| CVE-2024-48933 | LE Lemonldap::ng Lemonldap-ng | 6.1 | Oct 9 | A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if… |
| CVE-2023-44469 | LE Lemonldap::ng Lemonldap-ng | 4.3 | Sep 29 | A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs… |
| CVE-2019-19791 | LE Lemonldap::ng Lemonldap-ng | 9.8 | May 29 | In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG… |
| CVE-2022-37186 | LE Lemonldap::ng Lemonldap-ng | 5.9 | Apr 16 | In LemonLDAP::NG before 2.0.15 |
| CVE-2023-28862 | LE Lemonldap::ng Lemonldap-ng | 9.8 | Mar 31 | An issue was discovered in LemonLDAP::NG before 2.16.1 |
| CVE-2020-36659 | AP Apache::session::browsable Lemonldap-ng | 8.1 | Jan 27 | In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration… |
| CVE-2020-36658 | AP Apache::session::ldap Lemonldap-ng | 8.1 | Jan 27 | In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the… |
| CVE-2021-40874 | LE Lemonldap::ng Lemonldap-ng | 9.8 | Jul 18 | An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13 |
| CVE-2020-16093 | LE Lemonldap::ng Lemonldap-ng | 7.5 | Jul 18 | In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default… |
| CVE-2021-35472 | LE Lemonldap::ng Lemonldap-ng | 8.8 | Jul 30 | An issue was discovered in LemonLDAP::NG before 2.0.12 |
| CVE-2020-24660 | LH Lemonldap::ng Handler Lemonldap-ng | 9.8 | Sep 14 | An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used |
| CVE-2019-15941 | LE Lemonldap::ng Lemonldap-ng | 9.8 | Sep 25 | OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request |
| CVE-2019-13031 | LE Lemonldap:: Lemonldap-ng | 8.1 | Jun 28 | LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server |
| CVE-2019-12046 | LE Lemonldap::ng Lemonldap-ng | 9.8 | May 22 | LemonLDAP::NG -2.0.3 has Incorrect Access Control |
| CVE-2012-6426 | LE Lemonldap::ng Lemonldap-ng | – | Jan 1 | LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions… |