CVEs (3)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Pam Tacplus Project 1Pam Tacplus Nov 21, 2024 Apr 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure. |
1Pam Tacplus Project 1Pam Tacplus Jun 17, 2026 Oct 26, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. |
4Arista CanonicalDebian+1 more4Cloudvision Portal Debian LinuxPam Tacplus+1 moreJun 17, 2026 Jun 6, 2020 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. |