Conga

conga

Vendor: Redhat • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2014-3521 1Redhat 1Conga May 6, 2026 Oct 6, 2014 N/A· v4 N/A· v3 5.5 MEDIUM· v2 The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
CVE-2013-6496 1Redhat 1Conga May 6, 2026 Oct 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.
CVE-2013-7347 1Redhat 2Conga Enterprise Linux May 6, 2026 Mar 31, 2014 N/A· v4 N/A· v3 3.7 LOW· v2 Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vu...Show more Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.Show less
CVE-2012-3359 1Redhat 2Conga Enterprise Linux May 6, 2026 Mar 31, 2014 N/A· v4 N/A· v3 3.7 LOW· v2 Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT du...Show more Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.Show less
CVE-2011-0720 2Plone Redhat 3Conga LuciPlone Apr 29, 2026 Feb 3, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin...Show more Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.Show less
CVE-2007-4136 1Redhat 1Conga Apr 23, 2026 Nov 14, 2007 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.