Vulnerabilities > Openldap > Openldap > 2.4.37

DATE CVE VULNERABILITY TITLE RISK
2022-05-04 CVE-2022-29155 SQL Injection vulnerability in multiple products
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.
network
low complexity
openldap debian netapp CWE-89
critical
9.8
2021-05-28 CVE-2020-25710 Reachable Assertion vulnerability in multiple products
A flaw was found in OpenLDAP in versions before 2.4.56.
network
low complexity
openldap redhat debian fedoraproject CWE-617
7.5
2021-05-18 CVE-2020-25709 Reachable Assertion vulnerability in multiple products
A flaw was found in OpenLDAP.
network
low complexity
openldap debian apple redhat CWE-617
7.5
2020-12-08 CVE-2020-25692 NULL Pointer Dereference vulnerability in multiple products
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs.
network
low complexity
openldap redhat netapp CWE-476
7.5
2020-07-14 CVE-2020-15719 Improper Certificate Validation vulnerability in multiple products
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support.
network
high complexity
openldap redhat opensuse mcafee oracle CWE-295
4.0
2020-04-28 CVE-2020-12243 Uncontrolled Recursion vulnerability in multiple products
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
5.0
2019-07-26 CVE-2019-13565 An issue was discovered in OpenLDAP 2.x before 2.4.48.
network
low complexity
openldap canonical debian opensuse f5 apple oracle
7.5
2019-07-26 CVE-2019-13057 An issue was discovered in the server in OpenLDAP before 2.4.48. 3.5
2017-12-18 CVE-2017-17740 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
network
low complexity
openldap opensuse oracle mcafee CWE-119
5.0
2017-09-05 CVE-2017-14159 Improper Initialization vulnerability in multiple products
slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.
1.9