Search CVE reports
11 – 20 of 89 results
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train...
1 affected package
pam
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| pam | — | Ignored | Ignored | Ignored | Ignored |
Some fixes available 13 of 22
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix...
3 affected packages
freeradius, krb5, libpam-radius-auth
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| freeradius | Not affected | Fixed | Fixed | Fixed | Vulnerable |
| krb5 | Fixed | Fixed | Fixed | Fixed | Fixed |
| libpam-radius-auth | Not affected | Needs evaluation | Needs evaluation | Ignored | Needs evaluation |
linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
1 affected package
pam
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| pam | — | — | Fixed | Fixed | Fixed |
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a...
2 affected packages
sssd, libpam-krb5
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| sssd | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| libpam-krb5 | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not...
1 affected package
pam
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| pam | — | — | Fixed | Fixed | Fixed |
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
1 affected package
libpam-tacplus
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libpam-tacplus | Not in release | Not in release | Needs evaluation | Ignored | Ignored |
Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies....
7 affected packages
hiredis, discque, nginx, python-hiredis, redis...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| hiredis | Not affected | Not affected | Not affected | Not affected | Not affected |
| discque | Not in release | Not in release | Not in release | Not in release | Not in release |
| nginx | Not affected | Not affected | Not affected | Not affected | Not affected |
| python-hiredis | Not affected | Not affected | Not affected | Not affected | Not affected |
| redis | Not affected | Not affected | Not affected | Not affected | Not affected |
| rspamd | Not affected | Not affected | Not affected | Not affected | Not in release |
| webdis | Not affected | Not affected | Not affected | Not affected | Not in release |
pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesystem, in certain situations where the attacker's home directory is a FUSE filesystem mounted...
1 affected package
pam
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| pam | — | — | Not affected | Not affected | Not affected |
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature...
1 affected package
pam-u2f
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| pam-u2f | — | Not affected | Not affected | Not affected | Not affected |
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to...
1 affected package
spamassassin
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| spamassassin | — | — | — | Fixed | Fixed |