CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed...

Debian DLA-988-1 : rt-authen-externalauth security update

It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is vulnerable. For Debian 7 'Wheezy', these problems have been fixed in version...

CVE-2017-5192

When using the localbatch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. Mitigation Disable salt-api for mitigation...

Authentication flaw

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

PYSEC-2017-33

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

PYSEC-2017-33

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

UBUNTU-CVE-2016-3176

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

CVE-2016-3176

Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient...

SUSE-SU-2017:0292-1 Security update for dbus-1

This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed: - bsc1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included: - Change the default...

Mail.ru: Излишние права при авторизации через интерфейс mail.ru

account.mail.ru allows user to be authenticated by external mail password. If user is authenticated with external e-mail and e-mail's password via account.mail.ru interface, he can access some of the gaming sites without additional authentication, though these sites can use different account...

Error: "1816 (0x718) ERROR_NOT_ENOUGH_QUOTA - Unknown error" when trying to join XenServer to a Domain

If you are trying to add a Resource pool to to a specific OU in Active Directory you will get theerror : "Could not enable external authentication: 1816 0x718 ERRORNOTENOUGHQUOTA - Unknown error"...

PT-2016-7233 · Inspircd +2 · Inspircd +2

Name of the Vulnerable Software and Affected Versions: InspIRCd versions prior to 2.0.23 Description: The issue allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user by sending a crafted SASL message when the m sasl module is used with a service that...

Error: "The pool failed to enable external authentication" on XenServer

Unable to join the XenServer hosts to Active directory domain. The computer account is created in the domain but the following error continues to appear: Enabling Active Directory Authentication on pool … “Error: The pool failed to enable external authentication.” In the xensource.log the followi...

PT-2017-8352

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.5.10 Salt versions 2015.8.x prior to 2015.8.8 Description The issue allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient when PAM extern...

FreeBSD : salt -- Insecure configuration of PAM external authentication service (6d25c306-f3bb-11e5-92ce-002590263bf5)

SaltStack reports : This issue affects all Salt versions prior to 2015.8.8/2015.5.10 when PAM external authentication is enabled. This issue involves passing an alternative PAM authentication service with a command that is sent to LocalClient, enabling the attacker to bypass the configured...

Updated dbus packages fixes security vulnerability

Updated dbus packages provides security hardening and fixes some bugs Security hardening: On Unix platforms, change the default configuration for the session bus to only allow EXTERNAL authentication secure kernel-mediated credentials-passing, as was already done for the system bus. This avoids...

Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)

This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets the Pure-FTPd FTP server when it has been compiled with the --with-extauth flag and an external Bash script is used for authentication. If the server is not...

Gitblit External Authentication Providers未明验证绕过漏洞

Bugtraq ID:66324 Gitblit是一个纯Java库用来管理、查看和处理Git资料库。 相关Gitblit的External Authentication Providers存在错误，允许拥有合法用户名的攻击者利用漏洞绕过验证，进行未授权操作。 0 Gitblit 1.x Gitblit 1.4.1已经修复该漏洞，建议用户下载更新： http://gitblit.com...

CVE-2013-4435

Salt aka SaltStack 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine...

CVE-2013-4435

Salt aka SaltStack 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine...