CVE-2021-27780

CVE-2021-27780 affects HCL Technologies BigFix Mobile/Modern Client Management (versions v1.x, v2.0). The root cause is improper handling of XML interfaces in unauthenticated contexts, enabling Un-Auth XML interaction and unauthenticated device enrollment. Impact described in sources includes una...

CVE-2021-27780 HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment...

Security fix for the ALT Linux 10 package curl version 7.83.1-alt1

7.83.1-alt1 built May 19, 2022 Anton Farygin in task 299735 --- May 11, 2022 Anton Farygin - 7.83.1 - Fixes: CVE-2022-30115: HSTS bypass via trailing dot CVE-2022-27782: TLS and SSH connection too eager reuse CVE-2022-27781: CERTINFO never-ending busy-loop CVE-2022-27780: percent-encoded path...

Ubuntu: Security Advisory (USN-5412-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2022-131-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-27780

creationtimestamp| type| source ---|---|--- 2022-05-11 17:56:49+00:00| seen| https://t.me/ctinow/51778 2022-06-03 04:56:48+00:00| seen| https://t.me/cibsecurity/43647 2022-06-11 22:01:07+00:00| seen| https://t.me/ctinow/53635 2022-08-25 11:55:31+00:00| seen| https://t.me/truesecator/3334...

USN-5412-1: curl vulnerabilities

Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker could possibly use this issue to trick curl into using the wrong URL and bypass certain checks or filters. This issue only affected Ubuntu 22.04 LTS. CVE-2022-27780 Florian Kohnhuser discovered...

CVE-2022-27780

A vulnerability was found in curl. This issue occurs because the curl URL parser wrongly accepts percent-encoded URL separators like '/' when decoding the hostname part of a URL, making it a different URL using the wrong hostname when it is later retrieved. This flaw allows a malicious actor to...

Internet Bug Bounty: CVE-2022-27780: percent-encoded path separator in URL host

Advisory: https://curl.se/docs/CVE-2022-27780.html Original Report: https://hackerone.com/reports/1553841 Impact URL filter bypasses...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : curl vulnerabilities (USN-5412-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5412-1 advisory. Axel Chong discovered that curl incorrectly handled percent-encoded URL separators. A remote attacker could possibly use this iss...

CVE-2021-27780

The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment...

CVE-2020-27780 affecting package pam 1.3.1-4

CVE-2020-27780 affecting package pam 1.3.1-4. An upgraded version of the package is available that resolves this issue...

CVE-2020-27780

creationtimestamp| type| source ---|---|--- 2020-12-18 02:43:23+00:00| seen| https://t.me/cibsecurity/21042...

CVE-2020-27780

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

CVE-2020-27780

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

CVE-2020-27780

Linux-PAM (pam) prior to version 1.5.1 is vulnerable to an authentication bypass: if a non-existent username is supplied and the root password is empty, PAM may authenticate as root. Affected: pam components in Linux-PAM before 1.5.1. Root cause: handling of empty passwords for non-existing users...

Fedora 32 : pam (2020-bd83344365)

fix CVE-2020-27780: authentication bypass when the user doesn't exist Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[ASA-202012-13] pam: authentication bypass

Arch Linux Security Advisory ASA-202012-13 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-27780 Package : pam Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-1297 Summary ======= The package pam before version 1.5.0...

Fedora: Security Advisory for pam (FEDORA-2020-22532a1a81)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...