CVE-2022-25625

CVE-2022-25625 relates to Broadcom Symantec Privileged Access Management. The connected sources describe an elevation-of-privilege issue where a malicious unauthorized PAM user can access the administration configuration data and change values. The vulnerability is characterized by MFA-enabled en...

CVE-2022-25625

A malicious unauthorized PAM user can access the administration configuration data and change the values...

CLSA-2022-1661445415 Fixed CVE-2022-37451 in exim

CVE-2022-37451: fix invalid free in pamconverse...

Exim < 4.96 DoS

According to its banner, the version of Exim running on the remote host is prior to 4.96. It is, therefore, potentially affected by an invalid free error which can be exploited by a remote, unauthenticated attacker. Successful exploitation may result in a denial of service. This vulnerability...

CLSA-2022-1661173443 Fix CVE(s): CVE-2022-37452, CVE-2022-37451

SECURITY UPDATE: exim heap overflow in hostnamelookup - debian/patches/CVE-2022-37452.patch: fix hostnamelookup - CVE-2022-37452 SECURITY UPDATE: invalid free in pamconverse in auths/callpam.c - debian/patches/CVE-2022-37451.patch: fix PAM auth - CVE-2022-37451...

Security Bulletin: IBM MQ is vulnerable to a deadlock in the IBM MQ PAM feature. (CVE-2018-1419)

Summary Users of the IBM MQ PAM module feature can experience a deadlock causing further authentication attempts to fail resulting in a denial of service. Vulnerability Details CVEID: CVE-2018-1419 DESCRIPTION: IBM MQ, when configured to use a PAM module for authentication, could allow a user to...

CLSA-2022-1660761670 Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452

CVE-2022-37452: fix heap-based buffer overflow for the alias list in hostnamelookup - CVE-2022-37451: fix invalid free in pamconverse...

CLSA-2022-1660759272 Fixed CVEs in exim: CVE-2022-37451, CVE-2022-37452

CVE-2022-37452: fix heap-based buffer overflow for the alias list in hostnamelookup - CVE-2022-37451: fix invalid free in pamconverse...

Yubico pam-u2f: Local PIN Bypass vulnerability

Background Yubico pam-u2f is a PAM module for FIDO2 and U2F keys. Description A logic issue in Yubico pam-u2f could result in the bypass of a PIN entry requirement when authenticating with FIDO2. Impact An attacker with local access to certain applications using pam-u2f for authentication could...

GLSA-202208-11 : Yubico pam-u2f: Local PIN Bypass vulnerability

The remote host is affected by the vulnerability described in GLSA-202208-11 Yubico pam-u2f: Local PIN Bypass vulnerability - Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not...

DEBIAN-CVE-2022-37451

Exim before 4.96 has an invalid free in pamconverse in auths/callpam.c because storefree is not used after storemalloc...

UBUNTU-CVE-2022-37451

Exim before 4.96 has an invalid free in pamconverse in auths/callpam.c because storefree is not used after storemalloc...

PT-2022-3997 · Exim +1 · Exim +1

Name of the Vulnerable Software and Affected Versions: Exim versions prior to 4.96 Description: The issue is related to the use of memory after it has been freed in the pam converse function of the Exim mail server. This can be exploited by a remote attacker to impact the confidentiality,...

CVE-2022-37030

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module...

CVE-2022-37030

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module...

CVE-2022-37030

CVE-2022-37030 affects Grommunio Gromox: versions 0.5 through 1.x before 1.28. The issue is weak permissions on the PAM module’s configuration file, enabling a local unprivileged user in the gromox group to cause the PAM stack to execute arbitrary code when loading the module. Impact is local cod...

CVE-2022-37030

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module...

CVE-2022-37030

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module...

Grommunio Gromox 安全漏洞

Grommunio Gromox is a groupware server from Grommunio that replaces Microsoft Exchange. A security vulnerability exists in Grommunio Gromox versions prior to 1.28, which stems from weak permissions in the configuration file in the PAM module, and can be exploited by an attacker to allow the PAM...

Juniper Junos OS Vulnerability (JSA69719)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA69719 advisory. - A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module PAM of Juniper Networks Junos OS and Junos OS Evolv...