Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Authentication Bypass
Information Disclosure
Canonical
Ubuntu Linux
Point To Point Protocol
+1
NVD
CVSS 3.1
9.8
EPSS
1.9%
LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
PHP
Information Disclosure
Ldap Tool Box Self Service Password
NVD
GitHub
CVSS 3.0
9.8
EPSS
2.8%