pam
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-6018 | < 1.1.8-24.71.1 | Pam-config: lpe from unprivileged to allow_active in pam | HIGH 7.8 | 1.1 % | ||
| CVE-2024-10963 | 1.3.1 ; 1.5.1 ; 1.6.0 – < 1.7.0 | Pam: improper hostname interpretation in pam_access leads to access control bypass | HIGH 7.4 | 0.8 % | ||
| CVE-2024-10041 | 1.6.0 – < 1.6.0 | Pam: libpam: libpam vulnerable to read hashed password | MEDIUM 4.7 | 0.3 % | ||
| CVE-2020-27780 | pam 1.5.1 | A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't | CRITICAL 9.8 | 2.0 % |