Debian: Security Advisory (DSA-4446-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4446-1 : lemonldap-ng - security update

It was discovered that the Lemonldap::NG web SSO system performed insufficient validation of session tokens if the 'tokenUseGlobalStorage'option is enabled, which could grant users with access to the main session database access to an anonymous session. C Tenable Network Security, Inc. The...

[SECURITY] [DSA 4446-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4446-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 14, 2019 https://www.debian.org/security/faq -...

DSA-4446-1 lemonldap-ng - security update

Bulletin has no description...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

DEBIAN-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

Information disclosure

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

UBUNTU-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

CVE-2012-6426 affects LemonLDAP::NG prior to 1.2.3. The issue is that it does not use the Lasso library’s signature-verification capability, enabling remote attackers to bypass access-control restrictions through crafted SAML data. The description in connected records confirms the root cause and ...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

LemonLDAP:NG用户枚举及跨站脚本漏洞

BUGTRAQ ID: 33312 Lemonldap::NG是模块化的单点登录解决方案，可管理认证和授权。 在用户试图登录时如果帐号并不存在，Lemonldap::NG会返回一种错误；而当存在帐号但密码错误的话，Lemonldap::NG会返回另一种错误。这样远程攻击者就可以利用不同的返回信息判断是否存在特定的帐号。 Lemonldap::NG中index.pl没有正确地过滤url参数输入便返回给了用户，这允许远程攻击者通过提交恶意请求执行跨站脚本攻击。 ObjectWeb Consortium LemonLDAP:NG 0.9.3.1 ObjectWeb Consortium...