1761 matches found
Self-delgated users can have their delegation unknowingly hijacked during crowdfunding
Lines of code Vulnerability details Impact Self-delegation can be hijacked Proof of Concept PartyGovernance.solL886-L906 function adjustVotingPoweraddress voter, int192 votingPower, address delegate internal VotingPowerSnapshot memory oldSnap = getLastVotingPowerSnapshotForVotervoter; address...
Security Bulletin: IBM Security Verify Governance is vulnerable to a denial of service caused by multiple vulnerabilities.
Summary IBM Security Verify Governance is vulnerable to a denial of service caused by multiple vulnerabilities. FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system. IBM has addressed these vulnerabilites. Vulnerability Details CVEID:CVE-2019-14892...
Why Shadow APIs are More Dangerous than You Think
Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren't familiar with the term, shadow APIs are a type of application programming interface API that isn't officially documented or supported. Contrary...
Why Shadow APIs are More Dangerous than You Think
Shadow APIs are a growing risk for organizations of all sizes as they can mask malicious behavior and induce substantial data loss. For those that aren't familiar with the term, shadow APIs are a type of application programming interface API that isn't officially documented or supported. Contrary...
Security Bulletin: IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system [CVE-2013-4521, CVE-2013-2165 and CVE-2018-14667]
Summary IBM Security Verify Governance is vulnerable to remote attacks to execute arbitrary code on the system CVE-2013-4521. IBM Security Verify Governance is vulnerable to remote attacks caused by an error related to the handling of deserialization CVE-2013-2165. IBM Security Verify Governance ...
Security Bulletin: IBM Security Verify Governance is vulnerable to cross-site scripting, caused by improper validation of user-supplied input related to the HtmlResponseWriter (CVE-2013-5855)
Summary IBM Security Verify Governance is vulnerable to cross-site scripting, caused by improper validation of user-supplied input related to the HtmlResponseWriter. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within...
Security Bulletin: IBM Security Verify Governance is vulnerable to a denial of service caused by a Java StackOverflow exception(CVE-2020-36518),CVE-2020-25649,
Summary IBM Security Verify Governance is vulnerable to a denial of service caused by a Java StackOverflow exceptionCVE-2020-36518,IBM Security Verify Governance is vulnerable to a denial of service caused by an error when using JDK serialization to serialize and deserialize JsonNode values. By...
Security Bulletin: IBM Security Verify Governance is vulnerable to multiple issues (CVE-2021-31403, CVE-2020-36320, CVE-2019-25028)
Summary IBM Security Verify Governance is vulnerable to several issues due to vulnerabilities in Vaadin JAR, which ISV Governance uses as a web app framework. The fix involves upgrading the Vaadin JAR to the patched version. Vulnerability Details CVEID:CVE-2021-31403 DESCRIPTION: Vaadin could all...
Security Bulletin: IBM Security Verify Governance is vulnerable to a denial of service issue in an open source component
Summary IBM Security Verify Governance is vulnerable to a denial of service due to Jackson Core FasterXML, which IBM Security Verify Governance uses to parse XML data. The product has issued a fix which updates the vulnerable component. Vulnerability Details IBM X-Force ID: 220939 DESCRIPTION:...
Security Bulletin: IBM Security Verify Governance is vulnerable to remote security bypass (CVE-2022-3676)
Summary IBM Security Verify Governance is vulnerable to a security bypass due to use of Eclipse Openj9. IBM Security Verify Governance has addressed the issue by upgrading the vulnerable component. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker...
Security Bulletin: IBM Security Verify Governance is vulnerable to several issues due to vulnerabilities in Java SE (CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619)
Summary IBM Security Verify Governance is vulnerable to a denial of service and integrity issues due to vulnerabilities in Java SE. The fixed version of ISVG upgrades the Java to the patched version. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a denial of...
Security Bulletin: IBM Security Verify Governance is vulnerable to a remote attacker to obtain sensitive information (220723)
Summary IBM Security Verify Governance is vulnerable to is vulnerable to a remote attacker to obtain sensitive information due to vulnerabilities in Commons Fileupload file 220723. The fix involves upgrading the JAR to the patched version. Vulnerability Details IBM X-Force ID: 220723 DESCRIPTION:...
Security Bulletin: IBM Security Verify Governance is vulnerable to sensitive information exposure (CVE-2021-31403)
Summary IBM Security Verify Governance is vulnerable to sensitive information exposure due to vulnerabilities in Vaadin JAR CVE-2021-31403. The fix involves upgrading the Vaadin JAR to the patched version. Vulnerability Details CVEID:CVE-2021-31403 DESCRIPTION: Vaadin could allow a local attacker...
Think Before You Share the Link: SaaS in the Real World
Collaboration sits at the essence of SaaS applications. The word, or some form of it, appears in the top two headlines on Google Workspace's homepage. It can be found six times on Microsoft 365's homepage, three times on Box, and once on Workday. Visit nearly any SaaS site, and odds are...
Owner lowering max payout might break the MuteBonds contract
Lines of code Vulnerability details The maxPayout variable can be changed by the owner at any time. In case the owner lowers the maxPayout and the payoutTotal of the current epoch is greater than the new maxPayout the contract will be broken - no further deposit can be made, and most of the view...
Latest Microsoft Entra advancements strengthen identity security
If you read behind the attention-grabbing headlines, most novel techniques rely on compromised identities.1 In fact, of all the ways an attacker can get into your digital estate, identity compromise is still the most common.2 This makes identity your first line of defense. In many organizations,...
Where SSO Falls Short in Protecting SaaS
Single sign-on SSO is an authentication method that allows users to authenticate their identity for multiple applications with just one set of credentials. From a security standpoint, SSO is the gold standard. It ensures access without forcing users to remember multiple passwords and can be furth...
Security Bulletin: Security vulnerabilities have been identified in IBM DB2 used by IBM Security Verify Governance, Identity Manager virtual appliance component
Summary Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Security Verify...
Microsoft achieves first native Cloud Data Management Capabilities certification
Today, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC 14 Key Controls and Automations certification, conducted by Accenture and Avanade, accelerating the industry’s move to the cloud. The 14 Key Controls and Automations are a part of the EDM Council’s...
Microsoft achieves first native Cloud Data Management Capabilities certification
Today, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC 14 Key Controls and Automations certification, conducted by Accenture and Avanade, accelerating the industry’s move to the cloud. The 14 Key Controls and Automations are a part of the EDM Council’s...