CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

Code injection

In Delinea PAM Secret Server 11.4, it is possible for a user with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users...

Improper access control

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-25650

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

PT-2024-21067

Name of the Vulnerable Software and Affected Versions Delinea PAM Secret Server version 11.4 Description User enumeration can occur in the Authentication REST API, allowing a remote attacker to determine whether a user is valid due to a difference in responses from the "/oauth2/token" endpoint...

CVE-2024-25650

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This...

Delinea PAM Secret Server security vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A trust management issue vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to obtain symmetric keys and sensitive information via a crafted payload...

Delinea PAM Secret Server security vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A user enumeration vulnerability exists in Delinea PAM Secret Server version 11.4, which stems from a significant difference between valid and invalid login attempts, and can be exploited by a remote attacker to determine whether a...

CVE-2024-25653

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

PT-2024-21069

Name of the Vulnerable Software and Affected Versions Delinea PAM Secret Server version 11.4 Description The issue allows unprivileged users to view system reports and modify custom reports via the Report functionality in the Web UI when Unlimited Admin Mode is enabled. Recommendations For Deline...

CVE-2024-25651

A user enumeration vulnerability exists in the Authentication REST API of Delinea PAM Secret Server version 11.4 . A remote attacker can determine if a user account is valid by observing discrepancies in the responses returned from the /oauth2/token endpoint during login attempts. As a temporary ...

PT-2024-21066 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea PAM Secret Server version 11.4 Distributed Engine version 8.4.3 Description: The issue allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the "/pre-authenticate",...

CVE-2024-25653: Improper Access Control

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

PT-2024-21068 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea PAM Secret Server version 11.4 Description: The issue allows a user with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users. Recommendations: For Delinea PAM Secret Server...

CVE-2024-25653

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

CVE-2024-25652

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users through...

CVE-2024-25651: Observable Discrepancy

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

CVE-2024-25652: Improper Authentication

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users through...