sql-ledger sql-ledger vulnerabilities and exploits

(subscribe to this query)

Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the (1) id and possibly (2) db parameters in a Delete action to the output of a Vendors>Reports>Search search operatio...

Sql-ledger Sql-ledger 2.8.24

SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote malicious users to capture this cookie by intercepting its transmission within an http session.

Sql-ledger Sql-ledger 2.8.24

The CGI scripts in (1) LedgerSMB (LSMB) prior to 1.2.15 and (2) SQL-Ledger 2.8.17 and previous versions allow remote malicious users to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) prior to 1.2.15 and (2) SQL-Ledger 2.8.17 and previous versions allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and previous versions, and (2) LedgerSMB prior to 1.2.0, allows remote malicious users to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login param...

Sql-ledger Sql-ledger Ledgersmb Ledgersmb

1 EDB exploit

(1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote malicious users to access restricted functionality via direct requests. The LedgerSMB affected versions are prior to 1.3.0.

Ledgersmb Ledgersmb Sql-ledger Sql-ledger -

Directory traversal vulnerability in SQL-Ledger, and LedgerSMB prior to 1.1.5, allows remote malicious users to read and overwrite arbitrary files, and execute arbitrary code, via . (dot) characters adjacent to (1) users and (2) users/members strings, which are removed by blackli...

Sql-ledger Sql-ledger 2.6.25 Ledgersmb Ledgersmb

Unspecified vulnerability in LedgerSMB prior to 1.1.5 and SQL-Ledger prior to 2.6.25 allows remote malicious users to overwrite files and possibly bypass authentication, and remote authenticated users to execute unauthorized code, by calling a custom error function that returns f...

Ledgersmb Ledgersmb 1.1.0 Ledgersmb Ledgersmb 1.0.0 Sql-ledger Sql-ledger Ledgersmb Ledgersmb 1.1.1

SQL-Ledger prior to 2.4.4 stores a password in a query string, which might allow context-dependent malicious users to obtain the password via a Referer field or browser history.

Dws Systems Inc. Sql-ledger

login.pl in SQL-Ledger prior to 2.6.21 and LedgerSMB prior to 1.1.5 allows remote malicious users to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.

Dws Systems Inc. Sql-ledger 2.6.27

« PREV 1 2

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook