THREATIST.IORead the docs No Yubico vulnerabilities are listed in CISA KEV.
30 records
The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata.
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration.
The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP.
In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned.
In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of…
Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used.
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enabled), and does not properly verify that the path lacks symlinks pointing to othe…
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHS…
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04).
An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2.
An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2.
The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection.
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server.
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow.
A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver.
Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass.
A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6.
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1.
An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.
An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3.
An issue was discovered in Yubico libykpiv before 2.1.0.
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver.