IBM WebSphere MQ 8.0.0.x < 8.0.0.9 / 9.0.x < 9.0.5 / 9.0.0.x < 9.0.0.3 Multiple Vulnerabilities

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is version 8.0.0.x prior to 8.0.0.9, 9.0.x prior to 9.0.5 or 9.0.0.x prior to 9.0.0.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability. An...

Ubuntu: Security Advisory (USN-4552-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4552-1: Pam-python vulnerability

Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root...

USN-4552-1 pam-python vulnerability

Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as root...

Ubuntu 18.04 LTS : Pam-python vulnerability (USN-4552-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4552-1 advisory. Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as...

OpenSSH when using OPIE (One-Time Passwords in Everything) for PAM allows remote attackers to determine the existence of certain user accounts which displays a different response if the user account exists and is configured to use one-time passwords (OTP) a similar issue to CVE-2007-2243.

...

USN-4521-1 libpam-tacplus vulnerability

It was discovered that pamtacplus did not properly manage shared secrets if DEBUG loglevel and journald are used. A remote attacker could use this issue to expose sensitive information...

GLSA-202008-09 : Shadow: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-202008-09 Shadow: Privilege escalation When Shadow was installed with the PAM use flag, setuid binaries provided by Shadow were not properly restricted. Impact : A local attacker could escalate privileges to root. Workaround : The...

Shadow: Privilege escalation

Background Shadow is a set of tools to deal with user accounts. Description When Shadow was installed with the PAM use flag, setuid binaries provided by Shadow were not properly restricted. Impact A local attacker could escalate privileges to root. Workaround There is no known workaround at this...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

Design/Logic Flaw

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...

CVE-2020-24612

The CVE-2020-24612 issue affects the selinux-policy (Reference Policy) package 3.14–2020-08-24, where mishandling of the .config/Yubico directory in SELinux-enforced mode prevents pam-u2f from reading a user's U2F configuration. If nouserok is used, and the file cannot be read, second-factor auth...

In systemd before v242-rc4 it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker in some particular configurations to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

...

[SECURITY] Fedora 32 Update: mod_authnz_pam-1.2.1-1.fc32

modauthnzpam is a PAM authorization module, supplementing authentication done by other modules, for example modauthkerb; it can also be used as full Basic Authentication provider which runs the login, password authentication through the PAM stack...

SUSE SLES12 Security Update : xrdp (SUSE-SU-2020:1943-1)

This update for xrdp provides the following fix : CVE-2020-4044: xrdp-sesman can be crashed remotely over port 3350 bsc1173580. Fixed an issue where xrdp-sesman could not restart bsc1155952. Fixed an issue where xrdp could not start due to an error in the service file use absolute path in ExecSta...

SUSE-SU-2020:1943-1 Security update for xrdp

This update for xrdp provides the following fix: - CVE-2020-4044: xrdp-sesman can be crashed remotely over port 3350 bsc1173580. - Fixed an issue where xrdp-sesman could not restart bsc1155952. - Fixed an issue where xrdp could not start due to an error in the service file use absolute path in...

UBUNTU-CVE-2020-8903

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from th...