381 matches found
Fedora: Security Advisory (FEDORA-2024-7bc1df53fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-28862
An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an...
CVE-2021-40874
An issue was discovered in LemonLDAP::NG aka lemonldap-ng 2.0.13. When using the RESTServer plug-in to operate a REST password validation service for another LemonLDAP::NG instance, for example and using the Kerberos authentication method combined with another method with the Combination...
CVE-2021-35473
An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4...
CVE-2020-16093
In LemonLDAP::NG aka lemonldap-ng through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used...
CVE-2019-13031
LemonLDAP::NG before 1.9.20 has an XML External Entity XXE issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule...
CVE-2019-19791
In LemonLDAP::NG aka lemonldap-ng before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints when some LemonLDAP::NG setup options are used. For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive...
CVE-2019-15941
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the...
CVE-2012-6426
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...
Fedora: Security Advisory (FEDORA-2025-80dfa228e7)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 40 : lemonldap-ng (2025-80dfa228e7)
The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-80dfa228e7 advisory. See https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-21-0-is-out/ Tenable has extracted the preceding description block directly from the Fedora...
Fedora 41 : lemonldap-ng (2025-273b88cf62)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-273b88cf62 advisory. See https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-21-0-is-out/ Tenable has extracted the preceding description block directly from the Fedora...
[SECURITY] Fedora 40 Update: lemonldap-ng-2.21.0-1.fc40
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 41 Update: lemonldap-ng-2.21.0-1.fc41
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 42 Update: lemonldap-ng-2.21.0-1.fc42
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
Debian: Security Advisory (DSA-5897-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DLA-4119-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 5897-1] lemonldap-ng security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5897-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 08, 2025 https://www.debian.org/security/faq -...
[SECURITY] [DLA 4119-1] lemonldap-ng security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4119-1 [email protected] https://www.debian.org/lts/security/ Yadd April 08, 2025 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...
