439 matches found
CVE-2022-23527 Open Redirect in oidc_validate_redirect_url()
modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidcvalidateredirecturl does not properly check fo...
mod_auth_openidc 输入验证错误漏洞
modauthopenidc is a software application. It is an authentication/authorization module for the Apache 2.x HTTP server that is used as an OpenID Connect dependency to authenticate users against the OpenID Connect provider. An input validation error vulnerability exists in modauthopenidc prior to...
dovecot: Privilege escalation when similar master and non-master passdbs are used
A vulnerability was found in the Dovecot IMAP Server. When two passdb configuration entries exist in the Dovecot configuration, which have the same driver and args settings, the incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrect settings can lead...
pcs: improper authentication via PAM
A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon allowed expired accounts and accounts with expired passwords to log in when using PAM authentication. Unprivileged, expired accounts with previously denied access could still log in...
The vulnerability of the pam_access.so function in the Linux-PAM authentication module allows a hacker to circumvent existing security restrictions.
The vulnerability of the pamaccess.so module of the Linux-PAM authentication module is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...
Arvados 授权问题漏洞
Arvados is an open source platform for managing and analyzing biomedical big data. An authorization issue vulnerability exists in Arvados version 2.4.2 and prior versions, which stems from the fact that when a user is authenticated using the Portable Authentication Module PAM, Arvados can still b...
CVE-2022-25625
A malicious unauthorized PAM user can access the administration configuration data and change the values...
CVE-2022-25625
A malicious unauthorized PAM user can access the administration configuration data and change the values...
Exim 安全漏洞
Exim is an open source messaging agent MTA running on Unix systems that routes, forwards and delivers mail. A security vulnerability exists in Exim versions prior to 4.96, which stems from an invalid free in pamconverse in auths/callpam.c. The vulnerability is caused by the use of an invalid free...
PT-2022-23764 · Grommunio · Gromox
Name of the Vulnerable Software and Affected Versions: Grommunio Gromox versions 0.5 through 1.x before 1.28 Description: The issue is related to weak permissions on the configuration file in the PAM module, allowing a local unprivileged user in the gromox group to execute arbitrary code upon...
The vulnerability of the microprogramming software in the integrated facial authentication module of Intel RealSense ID Solution F450 allows a intruder to disclose protected information.
The vulnerability of the microprogramming software in the integrated facial authentication module of Intel RealSense ID Solution F450 is related to initialization errors. Exploiting this vulnerability can allow attackers to disclose protected information...
Oracle MySQL 输入验证错误漏洞
Oracle MySQL is an open source relational database management system from Oracle Corporation. MySQL Server is one of the database server components, and an input validation error vulnerability exists in Oracle MySQL 8.0.28 and earlier versions, which originates in the PAM Auth component of MySQL...
CVE-2022-22215
A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module PAM of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service DoS. It is possible that after the...
The vulnerability of the PAM auth function in the configuration management system and the remote execution of Salt operations allows a perpetrator to execute any commands they want.
The vulnerability of the PAM auth function in configuration management and remote execution of Salt operations is related to the absence of effective blocking for “locked accounts”. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
UBUNTU-CVE-2022-22967
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an...
OpenAM 安全漏洞
OpenAM Open Source Edition is an open source single sign-on framework. The product achieves transparent single sign-on e.g., centralized, distributed single sign-on in a network architecture by providing a core identity service Core Server. A security vulnerability exists in OpenAM that stems fro...
CVE-2021-44266
GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...
Intel BIOS firmware 安全漏洞
Intel BIOS firmware is a set of programs from the U.S. company Intel that are solidified onto a ROM chip on the motherboard inside a computer. A security vulnerability exists in Intel BIOS firmware, which arises from improper access control in the BIOS authentication code module and can be...
mod_auth_openidc: open redirect in oidc_validate_redirect_url()
A flaw was found in modauthopenidc where it does not sanitize redirection URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest...
