IBM Security Secret Server 信息泄露漏洞

IBM Security Secret Server is a set of privileged access management solutions from IBM USA. The product supports password management, privileged account identification and privileged session access monitoring and logging. An information disclosure vulnerability exists in IBM Security Secret Serve...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM, which can be exploited by an attacker to trigger a denial of service by pinging access to F5...

Vault’s AWS Auth Method Allows Authentication Bypass

Summary A vulnerability was identified in Vault and Vault Enterprise “Vault” such that, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and authentication bypassed. This vulnerability,...

Microsoft Azure Active Directory again a “Leader” in Gartner Magic Quadrant for Access Management

Howdy folks, I’m proud to announce that for the fourth year in a row, Microsoft Azure Active Directory Azure AD has been recognized as a “Leader” in Gartner Magic Quadrant for Access Management, Worldwide. Earlier this year, my boss, Joy Chik, CVP of Identity Engineering shared Microsoft’s guidin...

Microsoft Azure Active Directory again a “Leader” in Gartner Magic Quadrant for Access Management

Howdy folks, I’m proud to announce that for the fourth year in a row, Microsoft Azure Active Directory Azure AD has been recognized as a “Leader” in Gartner Magic Quadrant for Access Management, Worldwide. Earlier this year, my boss, Joy Chik, CVP of Identity Engineering shared Microsoft’s guidin...

Privilege escalation by backend users assigned to the default "Publisher" system role

Impact Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Patches Issue has been patched in...

CVE-2020-15248 Privilege escalation by backend users assigned to the default "Publisher" system role

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user ha...

Red Hat Keycloak Cross-Site Scripting Vulnerability (CNVD-2021-45281)

Red Hat Keycloak is an open source identity and access management solution for modern applications and services. A cross-site scripting vulnerability exists in Red Hat Keycloak versions prior to 12.0.0. The vulnerability stems from an insecure scheme that can be added to the redirecturi parameter...

What's New in Customer Identity and Access Management

We all know that the ability to accurately identify, understand, and engage our customers across multiple channels and digital touchpoints is absolutely vital to the digital customer experience and business. This couldn't be more important in the current environment as we continue to move more of...

Imperva 收购 jSonar： 新一代数据安全

我很高兴地宣布，Imperva 已达成收购 jSonar 的协议！我们认为，jSonar 令人难以置信的产品和技术与我们保护数据和所有通往数据的路径的使命完美契合。合并之后，我们将能够提供一种全新的数据安全方法，帮助企业满足当前和未来的需求。 Imperva，数据安全的先驱 Imperva 成立于 18 年前，其理念是通过融合应用程序和数据安全来保护组织的数字资产和信息。2020 年，全球最大的公司告诉我们一个道理，所有的安全性（包括网络和应用程序）最终目的都是为了保护数据。从长远来看，网络的存在是为了把人们带到应用程序中，而应用程序则负责读写数据。Imperva...

Imperva to acquire jSonar: A New Generation of Data Security

I’m thrilled to announce that Imperva has entered into an agreement to acquire jSonar! We view jSonar’s incredible product and technology as perfectly aligned with our mission to protect data and all paths to it. Together, we will be able to deliver a fundamentally new approach to data security t...

IBM Security Secret Server Input Validation Error Vulnerability

IBM Security Secret Server is a set of privileged access management solutions from IBM USA. The product supports password management, privileged account identification and privileged session access monitoring and logging. An input validation error vulnerability exists in IBM Security Secret Serve...

A week in security (August 3 – 9)

Last week on Malwarebytes Labs, on our Lock and Code podcast, we talked about identity and access management technology. We also wrote about business email compromises to score big, discussed how the Data Accountability and Transparency Act of 2020 looks beyond consent, and we analyzed how the...

The vulnerability of Google Chrome browser extensions, related to the lack of privilege control mechanisms and access management tools, allows attackers to gain access to confidential data.

The vulnerability of Google Chrome browser extensions is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows a malicious actor to gain access to confidential data through a specially created extension...

The vulnerability of the Windows Network Connections Service on Windows operating systems allows a perpetrator to escalate their privileges and execute arbitrary code.

The vulnerability of the Windows Network Connections Service in Windows operating systems is related to improper access management. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary code by launching a specially created application...

The vulnerability of the fly-wm window manager, related to the lack of mechanisms for privilege control and access management, allows a intruder to cause a service failure.

The vulnerability of the fly-wm window manager is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability in the user interface of Google Chrome’s Chromium browser allows a perpetrator to compromise data integrity.

The vulnerability of the Chromium browser’s user interface in Google Chrome is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows a malicious actor to affect data integrity through a specially created HTML page...

Lock and Code S1Ep12: Pinpointing identity and access management’s future with Chuck Brooks

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Chuck Brooks, cybersecurity evangelist and adjunct professor for Georgetown University’s Applied Intelligence Program and graduate Cybersecurity Programs...

Automatic Visibility And Immediate Security with Trend Micro + AWS Control Tower

Things fail. It happens. A core principle of building well in the AWS Cloud is reliability. Dr. Vogels said it best, “How can you reduce the impact of failure on your customers?” He uses the term “blast radius” to describe this principle. One of the key methods for reducing blast radius is the AW...

IBM Security Secret Server Information Disclosure Vulnerability (CNVD-2020-34985)

IBM Security Secret Server is a set of privileged access management solutions from IBM USA. The product supports password management, privileged account identification and privileged session access monitoring and logging. A security vulnerability exists in IBM Security Secret Server. A remote...