pamspy

pamspy -- Linux용 자격 증명 덤퍼 pamspy는 eBPF 기술을 활용하여 3snake와 동등한 작업을 수행합니다. PAMPluggable Authentication Modules 라이브러리 내의 특정 사용자 공간 함수를 추적합니다. 이 라이브러리는 다음과 같은 중요한 응용 프로그램에서 인증을 처리하는 데 사용됩니다: sudo sshd passwd gnome x11 기타 많은 ... 실행 방법? pamspy는 종속성 없는 정적 바이너리로 빌드되며, 릴리스 페이지에서 사용할 수 있습니다. Usage: pamspy...

pam_pkcs11

このプロジェクトはもうメンテナンスされていません 私は @LudovicRousseau ですが、もうこのソフトウェアを使用しておらず、管理する時間もありません。 「Pam-pkcs11 はすぐにでも新しいメンテナが必要です。さもなければ消滅します」を参照: https://sourceforge.net/p/opensc/mailman/message/35191905/ 新しいメンテナになりたい場合は、@LudovicRousseau に依頼して、あなたを https://github.com/orgs/OpenSC/teams/pampkcs11-maintainers...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

CVE-2026-48985 pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field

pamusb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, pusbisloginctllocal can cause a NULL dereference crash when parsing loginctl output. The function calls popen and reads the result; if the Remote field is only a newline, fgets succeeds...

CVE-2026-47270 pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...

EUVD-2026-32655

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pamusb is a PAM module loaded into the host process sudo, login, GDM, GNOME Shell. Display managers such as GDM run multiple concurrent authentication threads. Three functions used by the denyremote...

CVE-2026-47271 pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash

pamusb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, src/mem.c implemented out-of-memory guards for xmalloc, xrealloc, and xstrdup using assertdata != NULL. The C standard specifies that all assert expressions are compiled out when NDEBUG is defined at...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

Devolutions Server 安全漏洞

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. There is a security vulnerability in Devolutions Server, which stems from a lack of authorization in the PAM module. This...

CVE-2026-8407: Missing Authorization

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...

Exploit for CVE-2026-31431

CVE-2026-31431 Seccomp Mitigation A lightweight, reversible s...

The vulnerability of the PAM module of the Devolutions Server platform allows for the unauthorized reuse of passwords, user credentials, and confidential information. This makes it possible for attackers to reuse those passwords again.

The vulnerability of the PAM module of the Devolutions Server platform for centralized and secure management of passwords, user accounts, and confidential information exists due to a flaw in the password reset function. Exploiting this vulnerability allows a malicious actor to reuse an Oracle...

Advisory ROSA-SA-2026-3197

Software: pam 1.3.1 OS: ROSA Virtualization 2.1 unaffected versions = pam-1.3.1-39.rv3 affected versions pam-1.3.1-39.rv3 CVE-ID: CVE-2025-6020 BDU-ID: 2025-07273 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pamnamespace module of the Linux-PAM authentication module is caused by a race...

EulerOS Virtualization 2.10.0 : libcap (EulerOS-SA-2026-1177)

According to the versions of the libcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The PAM module pamcap.so of libcap configuration supports group names starting with @, during actual parsing, configurations not...