Latest ledgersmb ledgersmb Vulnerabilities

● CVE-2024-23831

Privilege escalation through CSRF attack on 'setup.pl'

Ledgersmb Ledgersmb>=1.3.0<1.10.30

Ledgersmb Ledgersmb>=1.11.0<1.11.9

● CVE-2021-3882

LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypte...

Ledgersmb Ledgersmb=1.8.0

Ledgersmb Ledgersmb>=1.8.0<1.8.22

● CVE-2021-3731

LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.

debian/ledgersmb

Ledgersmb Ledgersmb>=1.1.0<=1.1.12

Ledgersmb Ledgersmb>=1.2.0<=1.2.26

Ledgersmb Ledgersmb>=1.3.0<=1.3.47

Ledgersmb Ledgersmb>=1.4.0<=1.4.42

Ledgersmb Ledgersmb>=1.5.0<=1.5.30

and 5 more

● CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and infor...

debian/ledgersmb

Ledgersmb Ledgersmb>=1.1.0<=1.1.12

Ledgersmb Ledgersmb>=1.2.0<=1.2.26

Ledgersmb Ledgersmb>=1.3.0<=1.3.47

Ledgersmb Ledgersmb>=1.4.0<=1.4.42

Ledgersmb Ledgersmb>=1.5.0<=1.5.30

and 5 more

● CVE-2021-3693

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and ...

debian/ledgersmb

Ledgersmb Ledgersmb>=1.5.0<=1.5.30

Ledgersmb Ledgersmb>=1.6.0<=1.6.33

Ledgersmb Ledgersmb>=1.7.0<=1.7.32

Ledgersmb Ledgersmb>=1.8.0<=1.8.17

Debian Debian Linux=10.0

and 1 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.