11874 matches found
EUVD-2026-66200
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
PT-2026-82363
Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...
Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...
RockyLinux 10 : pam (RLSA-2026:59379)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59379 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...
CVE-2026-80199: Observable Timing Discrepancy
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
AlmaLinux 10 : pam (ALSA-2026:59379)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59379 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098748)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098748 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be...
RHEL 9 : pam (RHSA-2026:60224)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60224 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...
Oracle Linux 10 : pam (ELSA-2026-59379)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59379 advisory. 1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704 Tenable has extracted the preceding description block...
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in the TokenAuthenticator component. An unauthenticated attacker can enumerate valid usernames by measuring response time differences when sending requests via the X-AUTH-USER header, since the password hasher only executes for existing u...
CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-80199
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-18259
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
CVE-2026-18259
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...
CVE-2026-18259
The Drupal Token Content Access module (versions 0.0.0 through 3.1.2 ) is vulnerable to an observable timing discrepancy during access token comparison. This flaw allows a persistent attacker to perform a timing attack to guess valid access tokens by measuring response time differences, potential...