UBUNTU-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

Information disclosure

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

CVE-2012-6426 affects LemonLDAP::NG prior to 1.2.3. The issue is that it does not use the Lasso library’s signature-verification capability, enabling remote attackers to bypass access-control restrictions through crafted SAML data. The description in connected records confirms the root cause and ...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

LemonLDAP:NG用户枚举及跨站脚本漏洞

BUGTRAQ ID: 33312 Lemonldap::NG是模块化的单点登录解决方案，可管理认证和授权。 在用户试图登录时如果帐号并不存在，Lemonldap::NG会返回一种错误；而当存在帐号但密码错误的话，Lemonldap::NG会返回另一种错误。这样远程攻击者就可以利用不同的返回信息判断是否存在特定的帐号。 Lemonldap::NG中index.pl没有正确地过滤url参数输入便返回给了用户，这允许远程攻击者通过提交恶意请求执行跨站脚本攻击。 ObjectWeb Consortium LemonLDAP:NG 0.9.3.1 ObjectWeb Consortium...