CVE-2020-25754

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...

PT-2021-11178

Name of the Vulnerable Software and Affected Versions: Enphase Envoy versions R3.x and D4.x Description: A custom PAM module for user authentication in Enphase Envoy devices bypasses traditional authentication methods. This module generates a password from the MD5 hash of the username and serial...

CVE-2020-25754: Use of Password Hash With Insufficient Computational Effort

An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an...

[SECURITY] Fedora 34 Update: pam-kwallet-5.21.3-1.fc34

PAM module for KWallet...

Fedora: Security Advisory for pam-kwallet (FEDORA-2021-85c9774673)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Huawei EulerOS: Security Advisory for gnome-keyring (EulerOS-SA-2021-1300)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : gnome-keyring (EulerOS-SA-2021-1071)

According to the version of the gnome-keyring packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM...

Huawei EulerOS: Security Advisory for gnome-keyring (EulerOS-SA-2021-1071)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : gnome-keyring (EulerOS-SA-2020-2283)

According to the version of the gnome-keyring packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM...

IBM WebSphere MQ 8.0.0.x < 8.0.0.9 / 9.0.x < 9.0.5 / 9.0.0.x < 9.0.0.3 Multiple Vulnerabilities

According to its self-reported version, the IBM WebSphere MQ server installed on the remote Windows host is version 8.0.0.x prior to 8.0.0.9, 9.0.x prior to 9.0.5 or 9.0.0.x prior to 9.0.0.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability. An...

UBUNTU-CVE-2020-8903

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from th...

CVE-2018-20781

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext...

CVE-2011-4120

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

CVE-2011-4120

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

Design/Logic Flaw

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

CVE-2011-4120

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

CVE-2011-4120

The CVE-2011-4120 entry concerns the Yubico PAM Module prior to version 2.10. The vulnerability arises when the PAM module is configured as 'sufficient' and the 'use_first_pass' option is not used; under these conditions a remote attacker can authenticate by supplying a NULL password (pressing Ct...

CVE-2011-4120

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

CVE-2011-4120: Improper Input Validation

Yubico PAM Module before 2.10 performed user authentication when 'usefirstpass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the...

PT-2019-6689

Name of the Vulnerable Software and Affected Versions Yubico PAM Module versions prior to 2.10 Description The issue allows a remote attacker to bypass the common authentication process by providing a NULL value as the password string, potentially gaining access to an account. This can be achieve...