Most recent entries from all

EUVD-2026-76972

fkie_cve-2017-12197

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

GHSA-x9rg-q5fx-fx66 — Improper Input Validation in libpam4j

Affected: Maven: org.kohsuke:libpam4j

It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

gsd-2017-12197

RHSA-2017:2904 — Red Hat Security Advisory: rh-sso7-keycloak security update

jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass

UBUNTU-CVE-2017-12197

Affected: Ubuntu:14.04:LTS: libpam4j, Ubuntu:16.04:LTS: libpam4j