sql-ledger vulnerabilities and exploits

(subscribe to this query)

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks, which allows remote malicious users to run arbitrary executables and bypass authentication via a .. (dot dot) seq...

Sql-ledger Sql-ledger 2.6.27

The default configuration of SQL-Ledger 2.8.24 allows remote malicious users to perform unspecified administrative operations by providing an arbitrary password to the admin interface.

Sql-ledger Sql-ledger 2.8.24

The CGI scripts in (1) LedgerSMB (LSMB) prior to 1.2.15 and (2) SQL-Ledger 2.8.17 and previous versions allow remote malicious users to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) prior to 1.2.15 and (2) SQL-Ledger 2.8.17 and previous versions allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote malicious users to access restricted functionality via direct requests. The LedgerSMB affected versions are prior to 1.3.0.

Ledgersmb Ledgersmb Sql-ledger Sql-ledger -

Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and previous versions, and (2) LedgerSMB prior to 1.2.0, allows remote malicious users to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login param...

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

1 EDB exploit

Directory traversal vulnerability in SQL-Ledger, and LedgerSMB prior to 1.1.5, allows remote malicious users to read and overwrite arbitrary files, and execute arbitrary code, via . (dot) characters adjacent to (1) users and (2) users/members strings, which are removed by blackli...

Sql-ledger Sql-ledger 2.6.25 Ledgersmb Ledgersmb

Unspecified vulnerability in LedgerSMB prior to 1.1.5 and SQL-Ledger prior to 2.6.25 allows remote malicious users to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns f...

Ledgersmb Ledgersmb 1.0.0 Sql-ledger Sql-ledger Ledgersmb Ledgersmb 1.1.0 Ledgersmb Ledgersmb 1.1.1

SQL-Ledger prior to 2.4.4 stores a password in a query string, which might allow context-dependent malicious users to obtain the password via a Referer field or browser history.

Dws Systems Inc. Sql-ledger

login.pl in SQL-Ledger prior to 2.6.21 and LedgerSMB prior to 1.1.5 allows remote malicious users to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.

Dws Systems Inc. Sql-ledger 2.6.27

« PREV 1 2

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook