AlmaLinux 9.6 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.6:CLSA-2026:1789472351)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789472351 advisory. - Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Rocky Linux 9.4 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (ciqsa-2026_0557)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260557 advisory. This advisory aggregates security fixes for the pam SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-10963. Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787314091)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787314091 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the...

AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2025:1767001153)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1767001153 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

CentOS Linux 6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_idmap / libsss_idmap-devel / etc (CENTOS6:CLSA-2026:1789479226)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1789479226 advisory. - A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining...

CentOS Linux 7 [TuxCare] Security Update: pam / pam-devel (CENTOS7:CLSA-2025:1757532130)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1757532130 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2024:1718202007)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718202007 advisory. - linux-pam aka Linux PAM before 1.6.0 allows attackers to cause a denial of service blocked login process via mkfifo because the openat call...

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

CVE-2026-93330

A vulnerability exists in Devolutions Server 2026.3.5 due to improper rule enforcement within the PAM Active Directory provider . This flaw allows a user possessing PAM edit permissions to successfully bypass the Devolutions Gateway host ruleset . No information regarding specific exploit availab...

EUVD-2026-88982

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

CVE-2026-93330

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...

ROOT-OS-ALPINE-318-CVE-2024-22365 CVE-2024-22365 in linux-pam - Patched by Root

Root has patched CVE-2024-22365 in the linux-pam package for Root:Alpine:3.18. Multiple fixed versions available...

CVE-2025-6018_CVE-2025-6019_autopwn

Chained Exploit CVE-2025-6018 & CVE-2025-6019 Auto-Pwn This repository contains a full exploit chain "Auto-Pwn" targeting two critical vulnerabilities primarily affecting openSUSE Leap 15.x / SUSE systems: 1. CVE-2025-6018 : PAM Environment Injection. Allows a user to modify sensitive variables...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Local Privilege Escalation LPE - openSUSE / SUSE Linux Enterprise 15 Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x 🎯 Quick Summary CVE ID|...

Exploit-Chain-CVE-2025-6018-6019

https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt This exploit chains CVE-2025-6018 and CVE-2025-6019 to achieve local privilege escalation from an unprivileged user to root on vulnerable SUSE/openSUSE systems. CVE-2025-6018 is a PAM Pluggable Authentication Modules environment variabl...

copyfail-rs

copyfail-rs Multi-vector PoC + paired detection for CVE-2026-31431 CopyFail. Includes a novel PAM auth-bypass vector that no other public PoC ships. Detection mode catches what AIDE / Wazuh / OSSEC / Tripwire structurally cannot. Single static binary. 108 KB. nostd musl. Demo noot@host:$...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC A robust Proof of Concept PoC for chaining CVE-2025-6018 PAM/Polkit Active Session Bypass and CVE-2025-6019 libblockdev SUID Mount Flaw to achieve root access on vulnerable Linux systems. Disclaimer This tool is for educational purpose...

Updated pam packages fix a security vulnerability

The updated packages fix a security vulnerability: Linux-PAM pamuserdb Observable Timing Discrepancy in Plaintext Password Comparison. CVE-2026-54411...

MGASA-2026-0461 Updated pam packages fix a security vulnerability

The updated packages fix a security vulnerability: Linux-PAM pamuserdb Observable Timing Discrepancy in Plaintext Password Comparison. CVE-2026-54411...