74634 matches found
Astra Linux – Vulnerability in the 389-DS-base
A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...
Astra Linux – Vulnerability in PHP 8.1, PHP 7.3
In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, and 8.3. before 8.3.5, if a password stored using passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba. A race condition in the password lockout code may lead to the risk of brute-force attacks succeeding if certain conditions are met...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible Engine, affecting versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7. It also affects Ansible Tower in versions 3.4.5 and 3.5.5, as well as 3.6.3, when the ldapattr and ldapentry community modules are used. This issue exposes the LDAP bind...
Astra Linux – Vulnerability in Samba
The Samba AD DC administration tool, when working against a remote LDAP server, will, by default, send new or reset passwords over a signed-only connection...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible 2.7.16 and earlier versions, as well as 2.8.8 and earlier, and 2.9.5 and earlier. When a password is set using the “password” argument of the svn module, it is used in the svn command line, thereby exposing it to other users within the same node. An attacker could...
Astra Linux – Vulnerability in PHP 7.3
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16, and 8.2.X before 8.2.3, the passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hashes end up in the password database, it may allow an application to accept any password for that entry as valid...
Astra Linux – Vulnerability in python-oslo.utils
A flaw was discovered in python-oslo-utils. Due to improper parsing, passwords that contain double quotes " cause incorrect masking in debug logs, resulting in any part of the password after the double quote being displayed as plain text...
Astra Linux – Vulnerability in Shadow
A flaw was discovered in shadow-utils. When requesting a new password, shadow-utils asks for the password twice. If the password is incorrect on the second attempt, shadow-utils fails in clearing the buffer used to store the first entry. This may allow an attacker with sufficient access to retrie...
Astra Linux – Vulnerability in Samba
A design flaw was identified in Samba’s DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers RODCs. This flaw allows RODCs and users with the GETCHANGES permission to access all attributes, including sensitive...
Astra Linux – Vulnerability in Samba
A flaw was discovered in the way Samba implemented SMB1 authentication. An attacker could exploit this flaw to retrieve the plain-text password sent over the network, even if Kerberos authentication was required...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba. The security vulnerability occurs when the KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other’s tickets. A user who has been requested to change their password can exploit this flaw to obtain and use tickets for...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django versions 5.1.1, 5.0.9, and 4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view that implements password reset processes, allows remote attackers to enumerate user email addresses by sending password reset requests and observing the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: Platform/x86: think-lmi: Fixed the ordering of password opcodes for workstations. Lenovo workstations require that the password opcode be executed before the attribute value is changed if the Admin password is enabled. This issue...
Astra Linux – Vulnerability in freeipa
A flaw was discovered in all IPA versions ranging from 4.x.x to 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU resources, resulting in a denial of service and making the website unresponsive. The greatest...
EUVD-2026-31069
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass...
CVE-2026-47784
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass...
CVE-2026-47784
The CVE concerns memcached prior to 1.6.42, where SASL password data used for authentication is exposed to a timing side-channel via memcmp in sasl_server_userdb_checkpass. Affected versions are before 1.6.42; upgrading to 1.6.42 or later is the supported remediation per the release notes. The vu...
