pamspy

pamspy -- Recolector de credenciales para Linux pamspy aprovecha las tecnologías eBPF para lograr un trabajo equivalente a 3snake. Rastrea una función particular del espacio de usuario dentro de la biblioteca PAM Módulos de Autenticación Enchufables, utilizada por muchas aplicaciones críticas par...

pam_pkcs11

This project is no more maintained I @LudovicRousseau do not use this software any more and have no time to take care of it. See "Pam-pkcs11 needs a new maintainers soon, or it will die" https://sourceforge.net/p/opensc/mailman/message/35191905/ If you want to become the new maintainer just ask m...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

CVE-2026-48985 pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field

pamusb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusbisloginctllocal can cause a NULL dereference crash when parsing loginctl output. The function calls popen and reads the result; if the Remote field is only a newline, fgets succeeds...

CVE-2026-47270 pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...

EUVD-2026-32655

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...

CVE-2026-47271 pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc, xrealloc, and xstrdup using assertdata != NULL. The C standard specifies that all assert expressions are compiled out when NDEBUG is defined at...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

Devolutions Server 安全漏洞

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. There is a security vulnerability in Devolutions Server, which stems from a lack of authorization in the PAM module. This...

CVE-2026-8407: Missing Authorization

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

Exploit for CVE-2026-31431

CVE-2026-31431 Seccomp Mitigation A lightweight, reversible s...

The vulnerability of the PAM module of the Devolutions Server platform allows for the unauthorized reuse of passwords, user credentials, and confidential information. This makes it possible for attackers to reuse those passwords again.

The vulnerability of the PAM module of the Devolutions Server platform for centralized and secure management of passwords, user accounts, and confidential information exists due to a flaw in the password reset function. Exploiting this vulnerability allows a malicious actor to reuse an Oracle...

Advisory ROSA-SA-2026-3197

Software: pam 1.3.1 OS: ROSA Virtualization 2.1 unaffected versions = pam-1.3.1-39.rv3 affected versions pam-1.3.1-39.rv3 CVE-ID: CVE-2025-6020 BDU-ID: 2025-07273 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pamnamespace module of the Linux-PAM authentication module is caused by a race...

EulerOS Virtualization 2.10.0 : libcap (EulerOS-SA-2026-1177)

According to the versions of the libcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The PAM module pamcap.so of libcap configuration supports group names starting with @, during actual parsing, configurations not...