Lucene search
+L

5865 matches found

AlpineLinux
AlpineLinux
added 2025/08/09 2:00 a.m.85 views

CVE-2025-54999

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

3.7CVSS6.6AI score0.00193EPSS
SaveExploits0
Cvelist
Cvelist
added 2025/08/09 2:00 a.m.27 views

CVE-2025-54998 OpenBao Userpass and LDAP User Lockout Bypass

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by...

5.3CVSS0.00211EPSS
SaveExploits0References3
OSV
OSV
added 2025/08/09 2:00 a.m.12 views

CVE-2025-54998 OpenBao Userpass and LDAP User Lockout Bypass

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by...

5.3CVSS6.5AI score
SaveExploits0References5
CVE
CVE
added 2025/08/09 2:00 a.m.64 views

CVE-2025-54998

CVE-2025-54998 affects OpenBao versions 0.1.0–2.3.1, where an aliasing mismatch between pre-flight and full login user entity attributes allowed bypass of automatic user lockout in Userpass/LDAP auth. The issue is fixed in version 2.3.2. Remediation: upgrade to 2.3.2; as a workaround, apply rate-...

5.3CVSS6.8AI score0.00211EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment
added 2025/08/09 2:00 a.m.2 views

CVE-2025-54998 OpenBao Userpass and LDAP User Lockout Bypass

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by...

5.3CVSS7.1AI score0.00211EPSS
SaveExploits0References3
AlpineLinux
AlpineLinux
added 2025/08/09 2:00 a.m.76 views

CVE-2025-54998

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by...

5.3CVSS6.9AI score0.00211EPSS
SaveExploits0
CNNVD
CNNVD
added 2025/08/09 12:00 a.m.18 views

OpenBao 安全漏洞

OpenBao is OpenBao open source a sensitive data management software . A security vulnerability exists in OpenBao 2.3.1 and earlier versions that can be exploited by an attacker to cause bypassing of internal rate limiting and reuse of existing MFA code...

5.7CVSS6.6AI score0.00203EPSS
SaveExploits0References4
OSV
OSV
added 2025/08/08 2:44 p.m.13 views

GHSA-RXP7-9Q75-VJ3P OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

Impact OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the M...

5.7CVSS6.6AI score0.00203EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2025/08/08 2:44 p.m.27 views

OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

Impact OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the M...

5.7CVSS6.2AI score0.00203EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2025/08/08 2:41 p.m.25 views

OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

3.7CVSS5.8AI score0.00193EPSS
SaveExploits0References7Affected Software1
OSV
OSV
added 2025/08/08 2:41 p.m.44 views

GHSA-HH28-H22F-8357 OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

3.7CVSS6.3AI score0.00193EPSS
SaveExploits0References7
Github Security Blog
Github Security Blog
added 2025/08/08 2:38 p.m.27 views

OpenBao Userpass and LDAP User Lockout Bypass

Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. Patches OpenBao v2.3.2 will patch this issue. Workarounds Existing user...

5.3CVSS6.2AI score0.00211EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2025/08/08 2:38 p.m.29 views

GHSA-J3XV-7FXP-GFHX OpenBao Userpass and LDAP User Lockout Bypass

Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. Patches OpenBao v2.3.2 will patch this issue. Workarounds Existing user...

5.3CVSS6.8AI score0.00211EPSS
SaveExploits0References6
OSV
OSV
added 2025/08/08 5:54 a.m.13 views

BIT-MASTODON-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

7.5CVSS6.3AI score0.00536EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2025/08/08 12:29 a.m.19 views

CVE-2025-54879

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

7.5CVSS6.5AI score0.00536EPSS
SaveExploits0References1
Packet Storm News
Packet Storm News
added 2025/08/08 12:00 a.m.10 views

MALRIS: Malicious Hardware in RIS-Assisted Wireless Communications

Reconfigurable intelligent surfaces RIS enhance wireless communication by dynamically shaping the propagation environment, but their integration introduces hardware-level security risks. This paper presents the concept of Malicious RIS MALRIS, where compromised components behave adversarially, ev...

6.8AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2025/08/08 12:00 a.m.6 views

PT-2025-32384

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao’s Login Multi-Factor Authentication MFA system, utilizing Time-based One Time Password TOTP, accepted codes containing whitespace due to normalization applied by the underlying TOTP library...

9.8CVSS6.1AI score0.01105EPSS
SaveExploits0References53
Tenable Nessus
Tenable Nessus
added 2025/08/08 12:00 a.m.5 views

Linux Distros Unpatched Vulnerability : CVE-2024-10464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing...

7.5CVSS6.9AI score0.00601EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2025/08/08 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2023-53021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: fix possible use-after-free syzbot reported a nasty crash 1 in...

7.8CVSS5.5AI score0.00192EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2025/08/08 12:00 a.m.10 views

PT-2025-32380

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP authentication systems. This was caused by different aliasing between pre-flight and full login reque...

9.8CVSS6AI score0.01105EPSS
SaveExploits5References52
Rows per page
Query Builder