Privilege Escalation

matrix-js-sdk is vulnerable to privilege escalation. The vulnerability exists due to lack of identity verification which allows a key-requesting device to be impersonated...

PT-2021-22961 · Element +2 · Element Android +2

Name of the Vulnerable Software and Affected Versions: Element Android versions prior to 1.2.2 matrix-android-sdk2 aka Matrix SDK for Android versions prior to 1.2.2 Description: A logic error in the room key sharing functionality allows a malicious Matrix homeserver present in an encrypted room ...

CVE-2021-35964

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the...

Design/Logic Flaw

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the...

CVE-2021-35964

CVE-2021-35964 affects the Orca HCM digital learning platform. The admin/management page does not perform identity verification, enabling remote attackers to perform management functions without logging in. This can lead to access to members’ information and the ability to modify or delete course...

PT-2021-21084 · Orca Hcm · Orca Hcm

Name of the Vulnerable Software and Affected Versions: Orca HCM digital learning platform affected versions not specified Description: The management page of the Orca HCM digital learning platform does not perform identity verification, allowing remote attackers to execute management functions...

New API Lets App Developers Authenticate Users via SIM Cards

Online account creation poses a challenge for engineers and system architects: if you put up too many barriers, you risk turning away genuine users. Make it too easy, and you risk fraud or fake accounts. The Problem with Identity Verification The traditional model of online identity –...

CVE-2021-33577

An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves via encryption and signing of the message can be bypassed by changing the Content-Type of the message to text/plain...

How to Address the Current Complexity and Chaos of Cloud IAM

Cloudy judgement Combining the separate themes of cloud technology and identity access management IAM might seem like an oxymoron in today’s endlessly scaling environments, but there’s really no going back in the box when it comes to the promise of cloud in driving innovation. The fact is, securi...

Logic flaw vulnerability in the Witness Magic management system

Human ID magic management system is entropy-based technology for the "human ID" and independent research and development of the civil identity verification "real person" system platform. There is a logic flaw vulnerability in the system, which can be exploited by attackers to obtain sensitive...

CVE-2021-22860

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

Design/Logic Flaw

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860 EIC e-document system - Broken Authentication

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860

CVE-2021-22860 affects the EIC e-document system (Excellent Infotek Corporation). The vulnerability arises from incomplete identity verification when sorting and filtering personnel data, allowing a remote attacker to obtain user credentials without logging in and potentially gain privileged perm...

CVE-2020-14245

HCL OneTest UI V9.5, V10.0, and V10.1 does not perform authentication for functionality that either requires a provable user identity or consumes a significant amount of resources...

Would real identities make social media safer?

“Use real identities to reduce abuse online” is a talking point youve almost certainly seen down the years. It also seems to come around like clockwork every other month, and is currently a hot topic in the UK after prominent journalists / media personalities raised the issue. It’s an interesting...

Information Disclosure Vulnerability in Multiple Huawei Products (CNVD-2020-68354)

The Huawei P30 Pro, among others, is a smartphone from the Chinese company Huawei Huawei. A number of Huawei products suffer from an information disclosure vulnerability that stems from the failure to adequately verify the identity of a smart wearable device in a particular scenario, where an...

CVE-2020-16198

When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...

Code injection

Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. When an attacker claims to have a given identity, the software does not prove or insufficiently proves the claim is correct...

CVE-2020-16198 Philips Clinical Collaboration Platform Protection Mechanism Failure

When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct...