Sql-ledger - vulnerabilities (CVEs)
16 CVEs in 1 products, 0 in the last 30 days, newest from 2009-12-23.
Products
- Sql-ledger - 16 CVEs
Newest CVEs of Sql-ledger
- CVE-2009-3582 - CVSS 6.5 (medium), 2009-12-23: Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via…
- CVE-2009-4402 - CVSS 7.5 (high), 2009-12-23: The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to…
- CVE-2009-3581 - CVSS 3.5 (low), 2009-12-23: Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the…
- CVE-2009-3584 - CVSS 5 (medium), 2009-12-23: SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie…
- CVE-2009-3580 - CVSS 6.8 (medium), 2009-12-23: Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for…
- CVE-2009-3583 - CVSS 5.1 (medium), 2009-12-23: Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a…
- CVE-2008-4078 - CVSS 6.5 (medium), 2008-09-15: SQL injection vulnerability in the AR/AP transaction report in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allows remote…
- CVE-2008-4077 - CVSS 7.8 (high), 2008-09-15: The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource…
- CVE-2007-1923 - CVSS 7.5 (high), 2007-04-10: (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remote attackers to…
- CVE-2007-1541 - CVSS 7.5 (high), 2007-03-20: Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal…
- CVE-2007-1540 - CVSS 4.3 (medium), 2007-03-20: Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary…
- CVE-2007-1436 - CVSS 7.5 (high), 2007-03-13: Unspecified vulnerability in admin.pl in SQL-Ledger before 2.6.26 and LedgerSMB before 1.1.9 allows remote attackers to bypass authentication via unknown…
- CVE-2007-1437 - CVSS 9 (critical), 2007-03-13: Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows remote attackers to overwrite files and possibly bypass…
- CVE-2007-1329 - CVSS 10 (critical), 2007-03-07: Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, and execute…
- CVE-2007-0667 - CVSS 6.5 (medium), 2007-02-02: The redirect function in Form.pm for (1) LedgerSMB before 1.1.5 and (2) SQL-Ledger allows remote authenticated users to execute arbitrary code via redirects,…
- CVE-2006-4244 - CVSS 7.5 (high), 2006-08-31: SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid…
