sql-ledger sql-ledger vulnerabilities and exploits

(subscribe to this query)

SQL-Ledger 2.4.4 up to and including 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote malicious users to gain access as any logged-in user by setting the cookie and the par...

The redirect function in Form.pm for (1) LedgerSMB prior to 1.1.5 and (2) SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects, related to callbacks, a different issue than CVE-2006-5872.

Sql-ledger Sql-ledger 2.4.7 Sql-ledger Sql-ledger 2.6.19 Sql-ledger Sql-ledger 2.6.17 Sql-ledger Sql-ledger 2.6.25 Sql-ledger Sql-ledger 2.6.18 Ledgersmb Ledgersmb Sql-ledger Sql-ledger 2.6.21

Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger prior to 2.6.19 and (b) LedgerSMB prior to 1.0.0p1 allow remote malicious users to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash...

1 EDB exploit

Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 up to and including 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote malicious users to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.

Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote malicious users to include and execute arbitrary local files via a .. (dot dot) in the countrycode field.

Sql-ledger Sql-ledger 2.8.24

The default configuration of SQL-Ledger 2.8.24 allows remote malicious users to perform unspecified administrative operations by providing an arbitrary password to the admin interface.

Sql-ledger Sql-ledger 2.8.24

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks, which allows remote malicious users to run arbitrary executables and bypass authentication via a .. (dot dot) seq...

Sql-ledger Sql-ledger 2.6.27

Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote malicious users to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.

Sql-ledger Sql-ledger 2.8.24

Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts ...

Sql-ledger Sql-ledger 2.8.24

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook