CVE-2020-13881

In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.

• CWE-532

• http://www.openwall.com/lists/oss-security/2020/06/08/1Mailing List, Patch, Third Party Advisory
• https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0Patch, Third Party Advisory
• https://github.com/kravietz/pam_tacplus/issues/149Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00007.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/08/msg00006.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4521-1/Third Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/06/08/1Mailing List, Patch, Third Party Advisory
• https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0Patch, Third Party Advisory
• https://github.com/kravietz/pam_tacplus/issues/149Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00007.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/08/msg00006.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4521-1/Third Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50Third Party Advisory

Published

Jun 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13873A SQL Injection vulnerability in get_topic_info() in sys/COD…9.8
• CVE-2020-13877SQL Injection issues in various ASPX pages of ResourceXpress…9.8
• CVE-2020-13878IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27e…9.8
• CVE-2020-13879IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214…9.8
• CVE-2020-1388An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-13880IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cb…9.8
• CVE-2020-13882CISOfy Lynis before 3.0.0 has Incorrect Access Control becau…4.2
• CVE-2020-13883In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway…6.7
• CVE-2020-13884Citrix Workspace App before 1912 on Windows has Insecure Per…7.8
• CVE-2020-13885Citrix Workspace App before 1912 on Windows has Insecure Per…7.8
• CVE-2020-13886Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and…5.3
• CVE-2020-13887documents_add.php in Kordil EDMS through 2.2.60rc3 allows Re…8.8