Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server versions prior to 11.7.000001. An attacker exploits this vulnerability to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx...

PT-2024-3811

Name of the Vulnerable Software and Affected Versions Delinea Secret Server versions prior to 11.7.000001 Description The issue is related to the use of a hardcoded key for encryption in the Delinea Secret Server, allowing a remote attacker to bypass the authentication procedure. This can be...

Delinea PAM Secret Server Information Disclosure Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. An information disclosure vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to read data from a memory dump...

Delinea PAM Secret Server Security Bypass Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A security bypass vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to gain unauthorized access to a created remote session...

Delinea PAM Secret Server Access Control Error Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. An Access Control Error vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to view system reports and modify customized reports via the Reports feature in the Web UI when Unrestrict...

Delinea PAM Secret Server Trust Management Issue Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A trust management issue vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to obtain symmetric keys and sensitive information via a crafted payload...

Delinea PAM Secret Server User Enumeration Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A user enumeration vulnerability exists in Delinea PAM Secret Server version 11.4, which stems from a significant difference between valid and invalid login attempts, and can be exploited by a remote attacker to determine whether a...

CVE-2024-25653

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-25653

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

CVE-2024-25652

In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users through...

Improper access control

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

Code injection

In Delinea PAM Secret Server 11.4, it is possible for a user with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users...

CVE-2024-25650

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This...

CVE-2024-25650

Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This...

Delinea PAM Secret Server 安全漏洞

Delinea PAM Secret Server is a key service manager from Delinea. An Access Control Error vulnerability exists in Delinea PAM Secret Server version 11.4, which can be exploited by an attacker to view system reports and modify customized reports via the Reports feature in the Web UI when Unrestrict...

CVE-2024-25649

In Delinea PAM Secret Server 11.4, it is possible for an attacker with Administrator access to the Secret Server machine to read the following data from a memory dump: the decrypted master key, database credentials when SQL Server Authentication is enabled, the encryption key of RabbitMQ queue...

CVE-2024-25653

Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI...

CVE-2024-25649

An information disclosure vulnerability exists in Delinea PAM Secret Server version 11.4 . An attacker with Administrator access to the Secret Server machine can extract sensitive information from a memory dump . Exposed data may include the decrypted master key , database credentials (if SQL Ser...

PT-2024-21069

Name of the Vulnerable Software and Affected Versions Delinea PAM Secret Server version 11.4 Description The issue allows unprivileged users to view system reports and modify custom reports via the Report functionality in the Web UI when Unlimited Admin Mode is enabled. Recommendations For Deline...