CVE-2018-2417

Under certain conditions, the SAP Identity Management 8.0 pass of type ToASCII allows an attacker to access information which would otherwise be restricted...

CVE-2018-2416

CVE-2018-2416 affects SAP Identity Management 7.2 and 8.0, where XML from an untrusted source is not properly validated. Connected sources describe an XML External Entity Injection risk that could lead to information disclosure or denial of service. The documents do not specify affected subcompon...

Zero Trust and the Identity

Digital transformation is occurring faster than most people realize, and is impacting every component of the IT organization. Some of the many catalysts include users and applications moving outside the traditional perimeter, users accessing applications that are anywhere, and utilizing many...

How to Make Your Demo Environment Easy, Accessible...AND Secure

A common misconception I've heard in the field is that a tradeoff exists between easy access for applications and network security. For example, companies want to allow their sales team, partners, and prospects access into demo environments. With traditional access solutions, there is a question ...

CVE-2017-9284

IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information...

IBM Tivoli Identity Manager and Security Identity Manager Access Restriction Bypass Vulnerability

IBM Tivoli Identity Manager and Security Identity Manager are both products of IBM Corporation of the U.S.A. IBM Tivoli Identity Manager is a suite of identity management software used to manage user rights across heterogeneous IT resources.Security Identity Security Identity Manager is an identi...

Climbing the Ladder: Zero Trust, Single Sign-On, Multiple Applications

It is understood that there is a significant amount of complexity to securing today's enterprise, especially as more services and applications move to the cloud and a Zero Trust security model is employed. We at Akamai are actively engaged in helping enterprises adjust to a Zero Trust security...

UBUNTU-CVE-2016-9575

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary...

DEBIAN-CVE-2016-9575

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary...

Elevation of Privilege Vulnerability in Multiple EMC Products

EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA Identity Management and Governance are products of EMC Corporation.EMC RSA Identity Governance and Lifecycle is a suite of lifecycle management solutions; EMC RSA Identity Management and Governance IMG is a suite ...

CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

CVE-2018-1182

An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels hardware appliance and software bundle deployments only; RSA Via Lifecycle and Governance version 7.0, all patch levels hardware appliance and software bundle deployments only; RSA Identit...

Micro Focus NetIQ eDirectory Login Restriction Vulnerability

Micro Focus NetIQ eDirectory is an identity management infrastructure platform from Micro Focus UK that combines identity management architecture and directory services technology. The platform provides authentication policies, data backup and recovery services, and data disaster recovery. A...

CVE-2018-6009

In Yii Framework 2.x prior to 2.0.14, the switchIdentity() function in yii\web\User.php did not regenerate the CSRF token on identity changes, potentially allowing CSRF token mismatch after login state changes. Public advisories confirm this Cross‑Site Request Forgery risk. remediation: upgrade t...

SAML Post-Intrusion Attack Mirrors ‘Golden Ticket’

Researchers at CyberArk Labs have created a post-intrusion attack technique known as a Golden SAML that could allow an attacker to fake enterprise user identities and forge authentication to gain access to valuable cloud resources in a federation environment. “Using this post-exploit technique,...

CVE-2017-9273

The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes...

CVE-2017-9272

The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack...

Edith Wharton, Identity Theft, and the GDPR

During one of my talks for Gartner, I asked the audience, “How many of you have ever had anything stolen?” Many hands went up. Then I asked, “How did you know it was stolen?” The answers generally offered, “I looked for it, and it wasn’t there.” Data theft, and in particular identity theft, is...

August 10, 2017 – Morning Cyber Coffee Headlines – “PGA Championship” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 10, 2017 - Headlines One easy thing your agency can do to attract more...

Cross-Site Scripting Vulnerability in Multiple EMC Products

EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA Identity Management and Governance are products of EMC Corporation.EMC RSA Identity Governance and Lifecycle is a suite of lifecycle management solutions; EMC RSA Identity Management and Governance IMG is a suite...