CVE-2024-46999 User Grant Deactivation not Working in Zitadel

Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correctly. Deactivated user grants were still provided in token, which could lead to unauthorized access to applications and resources. Additionally, the management and auth API alway...

CVE-2024-47060

Zitadel contains a vulnerability (CVE-2024-47060) where deactivating an organization or project does not automatically revoke access to its applications. Multiple connected sources describe that even after deactivation, associated projects/applications remain active, allowing users from other org...

CVE-2024-47060 Unauthorized Access After Organization or Project Deactivation in Zitadel

Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized acces...

ROS-20240918-08

A vulnerability in FreeIPA's centralized user identity management system is associated with insufficient password hash calculation. Exploitation of the vulnerability could allow an attacker, acting remotely, to escalate their privileges by brute-forcing possible values for a user's password...

RHSA-2021:2026 Red Hat Security Advisory: ipa security update

Bulletin has no description...

OpenText eDirectory 安全漏洞

OpenText eDirectory is an identity management infrastructure platform that combines identity management architecture and directory services technology from OpenText Canada. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. A security...

OpenText eDirectory 安全漏洞

OpenText eDirectory is an identity management infrastructure platform that combines identity management architecture and directory services technology from OpenText Canada. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. A security...

Next-Generation Attacks, Same Targets - How to Protect Your Users' Identities

The FBI and CISA Issue Joint Advisory on New Threats and How to Stop Ransomware Note: on August 29, the FBI and CISA issued a joint advisory as part of their ongoing StopRansomware effort to help organizations protect against ransomware. The latest advisory, AA24-242A, describes a new cybercrimin...

FIWARE Keyrock Encryption Issue Vulnerability

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and prior versions, which arises from a predictable random value for user-created activation tokens that can be exploited by an attacker to predict...

CyberArk Identity Management Information Disclosure Vulnerability

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Unspecified Vulnerability in CyberArk Identity Management

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management suffers from a security vulnerability that stems from client-side execution of server-side security. No detailed vulnerability details are provided at this time...

FIWARE Keyrock Operating System Command Injection Vulnerability

FIWARE Keyrock is a FIWARE open source component responsible for identity management. An operating system command injection vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the function generateappcertificates in lib/appcertificates.js not being properly...

CyberArk Identity Management Information Disclosure Vulnerability (CNVD-2024-37456)

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

FIWARE Keyrock Encryption Problem Vulnerability (CNVD-2024-37462)

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the predictability of the algorithm used to create password reset tokens, and can be exploited by an attacker to...

FIWARE Keyrock OS Command Injection Vulnerability (CNVD-2024-37459)

FIWARE Keyrock is a FIWARE open source component responsible for identity management. An operating system command injection vulnerability exists in FIWARE Keyrock version 8.4 and earlier, which stems from the function generateappcertificates in controllers/saml2/saml2.js not being properly...

CyberArk Identity Management Information Disclosure Vulnerability (CNVD-2024-37457)

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

FIWARE Keyrock Encryption Problem Vulnerability (CNVD-2024-37461)

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...

The vulnerability of the CyberArk Identity Management access control system, related to the implementation of security functions at the client side, allows attackers to increase their privileges.

The vulnerability of the CyberArk Identity Management access control system lies in the implementation of security functions at the client side. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

CyberArk Identity Management 信息泄露漏洞

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

CyberArk Identity Management 信息泄露漏洞

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...