Skip to content
OpenAdvisories

Vendor

ledgersmb

5 known vulnerabilities.

Products

ledgersmb/ledgersmb 4 LedgerSMB 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2021-3882

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the …

    ledgersmb ledgersmb/ledgersmb ledgersmb Ubuntu
  • Medium 5.9
    CVE-2021-3731

    Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb

    LedgerSMB does not sufficiently guard against being wrapped by other sites, making it vulnerable to 'clickjacking'. This allows an attacker to trick a targetted user to execute unintended actions.

    ledgersmb ledgersmb/ledgersmb ledgersmb ledgersmb Debian Ubuntu