Secunia

Multiple vulnerabilities have been identified in SurgeLDAP allowing malicious people to conduct Cross Site Scripting attacks and cause a Denial of Service.

1) It is possible to cause the server to crash by requesting a long URL.

2) Usernames and passwords are stored in clear text in "surgeldap\user.dat".

3) The installation path is revealed if a non-existant file is requested.

4) The "cmd" parameter isn't properly verified in the "user.cgi" script, which allows trivial Cross Site Scripting attacks.

Solution
The vendor recommends that you restrict access to the HTTP service.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area