194 matches found
Security Bulletin: Security vulnerabilities have been discovered in IBM Verify Identity Access and IBM Security Verify Access
Summary Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2025-7962 DESCRIPTION: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate differe...
Harmonix on AWS 安全漏洞
Harmonix on AWS is a developer portal open-sourced by Amazon Web Services - Labs. A security vulnerability exists in Harmonix on AWS version 0.4.1 and earlier, which stems from an overly lax IAM trust policy that could lead to elevation of privilege...
EUVD-2025-201929
A vulnerability has been identified in COMOS V10.6 All versions, COMOS V10.6 All versions, NX V2412 All versions V2412.8700, NX V2506 All versions V2506.6000, Simcenter 3D All versions V2506.6000, Simcenter Femap All versions V2506.0002, Solid Edge SE2025 All versions V225.0 Update 10, Solid Edge...
Privilege Escalation
github.com/minio/minio is vulnerable to privilege escalation. The vulnerability is due to improper IAM session-policy validation, where restricted service or STS accounts can bypass inline policy checks when creating new service accounts, which allows an attacker to escalate privileges and gain...
Learn How Leading Companies Secure Cloud Workloads and Infrastructure at Scale
You've probably already moved some of your business to the cloud—or you're planning to. That's a smart move. It helps you work faster, serve your customers better, and stay ahead. But as your cloud setup grows, it gets harder to control who can access what. Even one small mistake—like the wrong...
GO-2025-4067 OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method in github.com/openbao/openbao-plugins. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2025-11621
Vault and Vault Enterprise’s “Vault” AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise...
CVE-2025-59048 OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method
OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a...
CVE-2025-59048
OpenBao's AWS Plugin (auth-aws) is affected by CVE-2025-59048: prior to v0.1.1, cross-account IAM role impersonation is possible when an untrusted account has a role with the same name as a trusted account, enabling unauthorized access in multi-account AWS setups. The issue has a patch in v0.1.1;...
PT-2025-43548
Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.21.0 Vault Enterprise versions prior to 1.21.0, 1.20.5, 1.19.11, and 1.16.27 Description The AWS Auth method in Vault and Vault Enterprise may allow authentication bypass if the bound principal iam role is identical...
MinIO 安全漏洞
MinIO is an open source object storage server from the US-based MinIO. The product supports building infrastructures for machine learning, analytics, and application data workloads. A security vulnerability exists in previous versions of MinIO 2025-10-15T17-29-55Z, which stems from an error in th...
PT-2025-42551
Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2025-10-15T17-29-55Z Description MinIO, a high-performance object storage system, contains a privilege escalation vulnerability in its IAM Identity and Access Management policy validation logic. The flaw affects...
CVE-2025-36087
IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound...
CVE-2025-36087 IBM Security Verify Access hard coded credentials
IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound...
IBM Security Verify Access（ISAM）和IBM Verify Identity Access Container 信任管理问题漏洞
IBM Security Verify Access ISAM and IBM Verify Identity Access Container are both products of International Business Machines IBM.IBM Security Verify Access is a service that improves user access security.IBM Verify Identity Access Container is containerized software that provides authentication...
Crimson Collective: A New Threat Group Observed Operating in the Cloud
Introduction Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that...
EUVD-2021-1410
Malware in sbrugna...
EUVD-2018-12422
Malware in sbrugna...
PT-2025-41180
『allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system』 IBM Security Verify Access and IBM Verify Identity Access products. CVE-2025-36354, CVE-2025-36355, CVE-2025-363546 https://t.co/SJGzwogo72...