Boost identity protection with Axiad Cloud and Microsoft Entra ID

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Passwords are a security weakness and phishing attacks to exploit accounts protected by passwords are on the rise. The last 12 months have seen an average of more than 4,000 password...

EmpowerID Data Forgery Issue Vulnerability

EmpowerID is an all-in-one identity management and cloud security suite from EmpowerID. EmpowerID version 7.205.0.0 previously had a data forgery issue vulnerability. An attacker could exploit the vulnerability to obtain sensitive information...

Malicious code in identity-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51996f6a2e2b1701e5670d8d169328ec0089179efef72ac9d2473f87ca47adf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-514 Malicious code in identity-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51996f6a2e2b1701e5670d8d169328ec0089179efef72ac9d2473f87ca47adf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DL1 bug fix and enhancement update

An update is available for custodia, module.custodia, pyusb, python-qrcode, module.slapi-nis, module.pyusb, module.softhsm, python-jwcrypto, python-kdcproxy, module.opendnssec, module.python-kdcproxy, module.ipa, ipa-healthcheck, softhsm, module.python-jwcrypto, ipa, opendnssec, python-yubico,...

IBM Security Directory Suite VA File Upload Vulnerability

IBM Security Directory Suite is a scalable, standards-based identity platform from International Business Machines IBM that simplifies identity and directory management. A file upload vulnerability exists in IBM Security Directory Suite VA, which can be exploited by an attacker to upload maliciou...

How Microsoft and Sonrai integrate to eliminate attack paths

Cloud development challenges conventional thinking about risk. A “perimeter” was always the abstraction that security teams could start from—defining their perimeter and exposing the cracks in firewalls and network access. With more and more infrastructure represented as ephemeral code, protectin...

PT-2023-21481 · Hcl · Hcl Domino Appdev Pack

Name of the Vulnerable Software and Affected Versions: HCL Domino AppDev Pack affected versions not specified Description: The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration issue. During a failed login attempt, a difference in messages could allow an attacker to...

DL1 bug fix update

An update is available for python-jwcrypto, python-qrcode, module.python-yubico, python-yubico, module.opendnssec, module.pyusb, python-kdcproxy, softhsm, pyusb, custodia, module.custodia, module.python-kdcproxy, bind-dyndb-ldap, opendnssec, module.python-jwcrypto, module.softhsm,...

The vulnerability of the connection method to the LDAP server lies in the LDAP connector of the Java Remote Connector Server (RCS) and the OpenIDM identity management system. This vulnerability stems from the lack of protection for the transmitted data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the LDAP connection method lies in the lack of protection for the data transmitted. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...

Forrester names Microsoft a Leader in 2023 Infrastructure-as-a-Service Platform Native Security report

As we continue to drive toward making the world safer and more productive for all, it is vital we empower our customers to secure every aspect of their organization. Each day we are seeing more advanced security threats as bad actors develop new tactics that aim to take advantage of businesses as...

Why Telecoms Struggle with SaaS Security

The telecom industry has always been a tantalizing target for cybercriminals. The combination of interconnected networks, customer data, and sensitive information allows cybercriminals to inflict maximum damage through minimal effort. It's the breaches in telecom companies that tend to have a...

Why Telecoms Struggle with SaaS Security

The telecom industry has always been a tantalizing target for cybercriminals. The combination of interconnected networks, customer data, and sensitive information allows cybercriminals to inflict maximum damage through minimal effort. It's the breaches in telecom companies that tend to have a...

Ping Identity PingFederate 跨站请求伪造漏洞

Ping Identity PingFederate is a flagship software-based federation server in the United States. used for identity management. Ping Identity PingFederate suffers from a cross-site request forgery vulnerability that stems from the /pf/idprofile.ping endpoint being susceptible to cross-site request...

Uncovering (and Understanding) the Hidden Risks of SaaS Apps

Recent data breaches across CircleCI, LastPass, and Okta underscore a common theme: The enterprise SaaS stacks connected to these industry-leading apps can be at serious risk for compromise. CircleCI, for example, plays an integral, SaaS-to-SaaS role for SaaS app development. Similarly, tens of...

Fortinet FortiAuthenticator Cross-Site Scripting Vulnerability (CNVD-2023-30842)

Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet. Fortinet FortiAuthenticator suffers from a cross-site scripting vulnerability that stems from an improper neutralization of script-related HTML tags in a web page, which can be exploited by an attacker t...

OpenIDM 安全漏洞

ForgeRock OpenIDM is an identity management system from ForgeRock Inc. in the United States. A security vulnerability exists in OpenIDM versions 1.5.20.9 through 1.5.20.13, which stems from the presence of a sensitive information plaintext transfer vulnerability...

Microsoft Secure: Explore innovations transforming the future of security

Building a more secure future requires an end-to-end approach. There is no question that technology plays an essential role, but security will always be human-centered. That’s what Microsoft Secure is all about. It’s about sharing knowledge, best practices, and technology innovations that empower...

THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps

Any app that can improve business operations is quickly added to the SaaS stack. However, employees don't realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk. Whether employees connect through Microsoft 365,...

THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps

Any app that can improve business operations is quickly added to the SaaS stack. However, employees don't realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk. Whether employees connect through Microsoft 365,...