CVE-2023-4641

MEDIUM Year: 2023
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-303
View all →

Vulnerability Description

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Related Vulnerabilities

CVE-2025-2475

MEDIUM
CVSS:5.4(Medium)

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one...

CWE-3032025

CVE-2025-3230

MEDIUM
CVSS:5.4(Medium)

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to ma...

CWE-3032025

CVE-2024-56128

MEDIUM
CVSS:5.3(Medium)

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism (SCR...

CWE-3032024

CVE-2024-35190

MEDIUM
CVSS:5.8(Medium)

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulner...

CWE-3032024

CVE-2022-4861

MEDIUM
CVSS:4.9(Medium)

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.

CWE-3032022

CVE-2023-39953

MEDIUM
CVSS:4.8(Medium)

user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allow...

CWE-3032023