CVE-2022-24756

Removed by vendor...

CVE-2022-24756 Missing Release of Memory after Effective Lifetime in Bareos Director

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director = 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that i...

CVE-2022-24756 Missing Release of Memory after Effective Lifetime in Bareos Director

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director = 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that i...

CVE-2022-24756

Bareos CVE-2022-24756 affects Bareos Director when built and configured for PAM authentication on versions before 21.1.0, 20.0.6, and 19.2.12. A failed PAM authentication can leak a small amount of memory, allowing an attacker who can access the PAM Console or WebUI to flood the Director with fai...

CVE-2022-24755

CVE-2022-24755 affects Bareos Director when built/configured for PAM: authorization checks were skipped, allowing login with expired accounts or passwords. Affected versions are Bareos Director >= 18.2 but before 21.1.0, 20.0.6, and 19.2.12. The root cause is missing authorization checks (circ...

CVE-2022-24755 Incorrect Authorization in Bareos Director

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director = 18.2 = 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts...

CVE-2022-24755

Removed by vendor...

CVE-2022-24755 Incorrect Authorization in Bareos Director

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director = 18.2 = 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts...

CVE-2022-24755 Incorrect Authorization in Bareos Director

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director = 18.2 = 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts...

Gitea < 1.16.4 Improper Authorization Vulnerability

Gitea is prone to an improper authorization vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

GHSA-GW5H-H6HJ-F56G Gogs vulnerable to improper PAM authorization handling

Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...

Gogs vulnerable to improper PAM authorization handling

Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...

Authorization Bypass

github.com/gogs/gogs is vulnerable to authorization bypass. When gogs is built and configured for PAM authentification, the library does not properly validate the authorization of the accounts, allowing an attacker to access expired accounts...

Authorization Bypass

cobbler is vulnerable to authorization bypass. When configuring cobbler-web to authenticate via PAM, The authenticate function of pam.py does not properly validate the authorization of the accounts, allowing an attacker to log into expired accounts...

Improper Authorization in Gogs

Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected. Patches Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or th...

GHSA-65F3-3278-7M65 Duplicate Advisory: Improper Authorization in Gogs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references. Original Description Impact Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use...

GHSA-MCG6-H362-CMQ5 Improper Authorization in cobbler

Impact If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places Web UI, CLI & XMLRPC-API. The same applies to user accounts with passwords set to be expired. Patches There is a patch for the latest...

Improper Authorization in cobbler

Impact If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places Web UI, CLI & XMLRPC-API. The same applies to user accounts with passwords set to be expired. Patches There is a patch for the latest...

Authorization Bypass

github.com/go-gitea/gitea is vulnerable to authorization bypass. The vulnerability exists in the Auth function in pam.go due to missing checks in the pam module, allowing a malicious attacker to log in and perform unauthorized actions...

Gitea Authorization Error Vulnerability

Gitea is a project to set up a self-hosted Git service. Gitea suffers from an authorization error vulnerability that stems from PAM authentication when building and configuring Gitea, which skips checking authorization altogether and can be exploited by attackers to log into expired accounts and...