CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-13565

CVE-2019-13565 affects OpenLDAP 2.x before 2.4.48. The issue arises when using SASL authentication with session encryption and relying on SASL security layers in slapd ACLs, allowing access that would normally be denied via a simple bind for identities covered by the ACLs. After the first SASL bi...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

UBUNTU-CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

CVE-2019-13565

An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs...

Sonatype Nexus Repository Manager Missing Access Controls RCE

The Sonatype Nexus Repository Manager server application running on the remote host is version 3.x prior to 3.15.0. It is, therefore, affected by a remote code execution vulnerability due to insufficient access controls. An unauthenticated, remote attacker can exploit this to bypass authenticatio...

Why Identity Aware Proxies are Key to Adaptive Access Controls

By now, you have likely heard the term "Zero Trust". From tech seminars and industry events to webinars and whitepapers, it is popping up everywhere. CISOs and CTOs are constantly inundated with calls and messages from different vendors proclaiming different ways their solutions can help them...

Facebook Agrees to Pay $5 Billion Fine and Setup New Privacy Program for 20 Years

The Federal Trade Commission FTC today officially confirmed that Facebook has agreed to pay a record-breaking $5 billion fine over privacy violations surrounding the Cambridge Analytica scandal. Besides the multibillion-dollar penalty, the company has also accepted a 20-year-long agreement that...

Defining Wallarm API-specific Rules

Case Study Using SugarCRM API As an Example A unique Wallarm AI feature is its ability to automatically detect and parse complicated API protocols and then set up security rules based on specific data or parameters deep inside the API. Once parsed, the system creates the rules-based both on where...

Tackling the Collaboration Conundrum

It’s 8 a.m. and you’ve just polished off a full cup of dark-roast coffee to jump-start your day. After booting up your PC, you instinctively open up Outlook, along with Slack or Teams or TeamViewer. While chatting with a co-worker, you recall that you need to send administrative credentials to he...

vGate Security Disclosure

The vulnerability of the vGate virtualization platform’s security mechanism is related to insufficient control over operations within the vSphere environment. This allows clones of machines to be created on another vCenter without checking the permission rules for access restrictions set by vGate...

Johnson Controls exacqVision Server

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor : Exacq Technologies, Inc., a subsidiary of Johnson Controls Equipment : exacqVision Server Vulnerability : Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated user to elevate their...

New Azure Marketplace Pay-As-You-Go Billing for Trend Micro Deep Security as a Service

Cloud adoption continues to rise as organizations reduce their data center footprint, look to cloud native technologies to improve their application design and output, and strive to improve scalability and management of resources and systems. In a recent survey conducted by analyst firm ESG, 87% ...

July 16, 2019—KB4507466 (OS Build 17134.915)

None None...

Insecure Access Controls

mediawiki/core is vulnerable to authorization bypass. Improper checks on the limits on IP range blocks $wgBlockCIDRLimit within the API allows an attacker to obtain unauthorized access to the API...

Insecure Access Controls

mediawiki/core uses insecure access controls. Unauthorized users are able to retrieve suppressed username or log in Special:EditTags information...

Insecure Access Controls

nuget package manager uses insecure access controls. An authenticated attacker is able to tamper and modify contents of the intermediate build folder obj...

Information Disclosure

sonarqube is vulnerable to information disclosure. Improperly configured access controls of the API allows an attacker to discover valid user account logins...

Debian: Security Advisory (DLA-1845-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-11421

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and authenticity security controls. All information is sent in plain text, and can be intercepted and modified. The protocol is vulnerable to...