CVE-2004-2253

CVE-2004-2253 describes a directory traversal in SurgeLDAP’s web component. Affected: SurgeLDAP 1.0g and earlier. Issue: an attacker can exploit a ".." in the page parameter of the show command in user.cgi to read arbitrary files from the server. The connected documents corroborate this file-disc...

CVE-2004-2254

SurgeLDAP 1.0g (Build 12), and possibly earlier 1.0h, contains an authentication bypass vulnerability in the administration interface. The issue allows remote attackers to bypass login by sending a direct request to admin.cgi with a modified utoken parameter. The affected product/version informat...