Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2024-10041

Pam: libpam: libpam vulnerable to read hashed password

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux Rhel Els and 1 more
CVE-2022-28321

pam: authentication bypass for SSH logins

The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Linux-pam Opensuse
Products
Linux-pam Tumbleweed
CVE-2026-54411

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2024-22365

pam: allowing unprivileged user to block another user namespace

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2009-0579

pam: MINDAYS not respected by pam for password changing

Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2009-0887

pam: integer signedness error in _pam_StrTok()

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.

CVSS 2.0 · 6.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2014-2583

pam: path traversal issue in pam_timestamp's format_timestamp_name()

Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.

CVSS 2.0 · 5.8 Medium EPSS 4.1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2015-3238

pam: DoS/user enumeration due to blocking pipe in pam_unix module

The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.

CVSS 3.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Linux-pam Oracle Redhat
Products
Linux-pam Sparc-opl Service Processor Enterprise Linux
CVE-2010-4707

pam: pam_xauth: Does not check if certain ACL file is a regular file

The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2010-4708

pam: pam_env: reading ~/.pam_environment is security risk

The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2011-3148

(pam_env): Stack-based buffer overflow by parsing user's pam_environment file

Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2011-3149

(pam_env): Infinite loop by expanding certain arguments

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2010-3316

pam: pam_xauth missing return value checks from setuid() and similar calls

The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2010-4706

pam: pam_xauth: Improper handling of failure to determine certain target uid

The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target uid, which might allow local users to delete unintended files by executing a program that relies on the pam_xauth PAM check.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2010-3853

pam: pam_namespace executes namespace.init with service's environment

pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2010-3435

pam: pam_env and pam_mail accessing users' file with root privileges

The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam Redhat
Products
Linux-pam Enterprise Linux
CVE-2010-3431

pam: pam_mail and pam_env incorrect privilege dropping

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2010-3430

pam: pam_mail and pam_env incorrect privilege dropping

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam
CVE-2020-27780

pam: authentication bypass when the user doesn't exist and root password is blank

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Linux-pam
Products
Linux-pam