3586 matches found
CVE-2023-5240
Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passwords stored in it via a GET request...
sssd bug fix update
An update is available for sssd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...
SUSE SLES12 Security Update : xrdp (SUSE-SU-2023:3735-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3735-1 advisory. - CVE-2023-40184: Fixed restriction bypass via improper session handling bsc1214805. Tenable has extracted the preceding description block...
Think Your MFA and PAM Solutions Protect You? Think Again
When you roll out a security product, you assume it will fulfill its purpose. Unfortunately, however, this often turns out not to be the case. A new report, produced by Osterman Research and commissioned by Silverfort, reveals that MFA Multi-Factor Authentication and PAM Privileged Access...
Fedora 38 : xrdp (2023-b1d585e148)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b1d585e148 advisory. Release notes for xrdp v0.9.23 2023/08/31 General announcements - Running xrdp and xrdp-sesman on separate hosts is still supported by this release,...
Fedora 37 : xrdp (2023-40298f6951)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-40298f6951 advisory. Release notes for xrdp v0.9.23 2023/08/31 General announcements - Running xrdp and xrdp-sesman on separate hosts is still supported by this release,...
Oracle Linux 5 : pam (ELSA-2007-0555)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0555 advisory. - CVE-2007-3102 - prevent audit log injection through user name 243204 Tenable has extracted the preceding description block directly from the Oracle...
CVE-2023-40184
xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...
CVE-2023-40184
xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...
CVE-2023-40184 Improper handling of session establishment errors in xrdp
xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...
CVE-2023-40184 Improper handling of session establishment errors in xrdp
xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...
CVE-2023-40184
xrdp is an open source remote desktop protocol RDP server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in in session...
xrdp -- Improper handling of session establishment errors allows bypassing OS-level session restrictions
xrdp team reports: In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The authstartsession function can return non-zero 1 value on, e.g., PAM error which may result in session restrictions such as max concurrent sessions p...
Important: monit
Issue Overview: An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization. CVE-2022-26563 Affected Packages: monit Issue Correction: Run yum update monit or yum update --advisory ALAS-2023-1805 to update your...
PT-2023-6794
Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.9.23 Description The issue is related to the improper handling of session establishment errors in xrdp, allowing bypassing of OS-level session restrictions. The auth start session function can return a non-zero value o...
Improper Authorization
monit is vulnerable to Improper Authorization. This vulnerability occurs due to the improper PAM-authorization, resulting in remote malicious attackers gaining escalated privileges...
Webinar - Making PAM Great Again: Solving the Top 5 Identity Team PAM Challenges
Privileged Access Management PAM solutions are widely acknowledged as the gold standard for securing critical privileged accounts. However, many security and identity teams face inherent obstacles during the PAM journey, hindering these solutions from reaching their full potential. These challeng...
FreeBSD-SA-23:09.pam_krb5
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:09.pamkrb5 Security Advisory The FreeBSD Project Topic: Network authentication attack via pamkrb5 Category: core Module: pamkrb5 Announced: 2023-08-01...
SUSE-SU-2023:3066-1 Security update for samba
This update for samba fixes the following issues: - CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend bsc1213174. - CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability bsc1213173. - CVE-2023-34967: Fix...