ROOT-OS-DEBIAN-11-CVE-2024-10041 CVE-2024-10041 in pam - Patched by Root

Root has patched CVE-2024-10041 in the pam package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-54411 CVE-2026-54411 in pam - Patched by Root

Root has patched CVE-2026-54411 in the pam package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...

ROOT-OS-UBUNTU-2004-CVE-2024-10041 CVE-2024-10041 in pam - Patched by Root

Root has patched CVE-2024-10041 in the pam package for Root:Ubuntu:20.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2024-10041 CVE-2024-10041 in pam - Patched by Root

Root has patched CVE-2024-10041 in the pam package for Root:Ubuntu:24.04. Multiple fixed versions available...

RHSA-2026:56131 Red Hat Security Advisory: pam security update

Bulletin has no description...

pam security update

An update is available for pam. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Pluggable Authentication Modules PAM provide a system to set up authentication...

RockyLinux 8 : pam (RLSA-2026:56131)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

MiracleLinux 8 : pam-1.3.1-40.el8_10 (AXSA:2026-1577:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1577:02 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block direct...

Oracle Linux 8 : pam (ELSA-2026-56131)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-56131 advisory. 1.3.1-40.0.1 - pamlimits: fix use after free in pamsmopensession Orabug: 36272695 1.3.1-40 - pamuserdb: fix password comparison timing leak. Resolves:...

AlmaLinux 8 : pam (ALSA-2026:56131)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:56131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly fr...

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

A flaw was found in Linux-PAM's pamuserdb module. This vulnerability, categorized as an Observable Timing Discrepancy CWE-208, allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during...

Moderate: Red Hat Security Advisory: pam security update

An update for pam is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

Unity Linux 20.1070e Security Update: pam (UTSA-2026-099450)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099450 advisory. Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in modules/pamuserdb/pamuserdb...

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

The vulnerability of the `pam_passkey_child_read_data()` function in the `src/responder/pam/pamsrv_passkey.c` file of the access control service for remote directories and the SSSD authentication mechanism allows a hacker to cause a service failure.

The vulnerability of the pampasskeychildreaddata function in the src/responder/pam/pamsrvpasskey.c file, belonging to the remote directory access control service and the SSSD authentication mechanism, is related to a buffer overflow. Exploiting this vulnerability could allow an attacker to cause ...

Astra Linux – Vulnerability in sssd

A flaw was discovered in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Since the data is treated as a NUL-terminated C string without an explicit termination, this leads to a...

SUSE-SU-2026:23171-1 Security update for sssd

This update for sssd fixes the following issue: - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807...

OPENSUSE-SU-2026:21540-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...