Advisories · Technology
himmelblau.
Every CVE that names himmelblau among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.4 High
Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow
- himmelblau
- Broken access control
- CVSS 6.3 Medium
himmelblau: NSS fake-primary group lookup reintroduces name collision risk
- himmelblau
- Privilege escalation
- CVSS 8.8 High
himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache
- himmelblau
- Path traversal
- CVSS 10.0 CriticalCritical · CVSS 9+
Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
- himmelblau
- CWE-1188
- CVSS 4.4 Medium
Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)
- himmelblau
- CWE-1188
- CVSS 7.1 High
Himmelblau's Kerberos credential cache collection is world readable
- himmelblau
- Hard-coded credentials
- CVSS 2.8 Low
Himmelblau leaks an Intune service access token in its logs
- himmelblau
- Information disclosure
- CVSS 5.2 Medium
Himmelblau offline auth permits authentication with invalid Hello PIN
- himmelblau
- Authentication bypass
- CVSS 5.4 Medium
Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass
- himmelblau
- Authentication bypass
- CVSS 3.2 Low
Himmelblau leaks credentials in the debug log
- himmelblau
- Information disclosure