CVE-2022-28321

CVE-2022-28321 affects Linux-PAM on openSUSE Tumbleweed/Factory. The pam_access.so module may bypass SSH login restrictions when a connecting IP cannot be resolved via DNS, allowing a user with denied access to still authenticate. Root cause: login restriction logic in pam_access.so fails for non...

CVE-2022-28321

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pamaccess.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a...

CVE-2022-40300

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities...

How Uber was hacked in 2022

What happened? The first information about the incident was issued yesterday, September 15th, 2022. We know that a hacker called “Tea Pot” successfully accessed Uber infrastructure and critical cloud services such as AWS, Slack, Google Workspace, and others. Most likely, Uber understood what had...

Debian dla-3108 : pcs - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3108 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3108-1 [email protected] https://www.debian.org/lts/security/...

mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server...

mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

pam bug fix and enhancement update

An update is available for pam. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Pluggable Authentication Modules PAM provide a system to set up authentication...

Debian DSA-5226-1 : pcs - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5226 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using...

[SECURITY] [DSA 5226-1] pcs security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5226-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 06, 2022 https://www.debian.org/security/faq -...

OESA-2022-1886 pcs security update

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters. Security Fixes: A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired passwords to login whe...

CVE-2022-25625

A malicious unauthorized PAM user can access the administration configuration data and change the values...

Design/Logic Flaw

A malicious unauthorized PAM user can access the administration configuration data and change the values...

CVE-2022-25625

A malicious unauthorized PAM user can access the administration configuration data and change the values...

CVE-2022-25625

CVE-2022-25625 relates to Broadcom Symantec Privileged Access Management. The connected sources describe an elevation-of-privilege issue where a malicious unauthorized PAM user can access the administration configuration data and change values. The vulnerability is characterized by MFA-enabled en...

CLSA-2022-1661445415 Fixed CVE-2022-37451 in exim

CVE-2022-37451: fix invalid free in pamconverse...

Exim < 4.96 DoS

According to its banner, the version of Exim running on the remote host is prior to 4.96. It is, therefore, potentially affected by an invalid free error which can be exploited by a remote, unauthenticated attacker. Successful exploitation may result in a denial of service. This vulnerability...

CLSA-2022-1661173443 Fix CVE(s): CVE-2022-37452, CVE-2022-37451

SECURITY UPDATE: exim heap overflow in hostnamelookup - debian/patches/CVE-2022-37452.patch: fix hostnamelookup - CVE-2022-37452 SECURITY UPDATE: invalid free in pamconverse in auths/callpam.c - debian/patches/CVE-2022-37451.patch: fix PAM auth - CVE-2022-37451...

Security Bulletin: IBM MQ is vulnerable to a deadlock in the IBM MQ PAM feature. (CVE-2018-1419)

Summary Users of the IBM MQ PAM module feature can experience a deadlock causing further authentication attempts to fail resulting in a denial of service. Vulnerability Details CVEID: CVE-2018-1419 DESCRIPTION: IBM MQ, when configured to use a PAM module for authentication, could allow a user to...

CLSA-2022-1660761670 Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452

CVE-2022-37452: fix heap-based buffer overflow for the alias list in hostnamelookup - CVE-2022-37451: fix invalid free in pamconverse...