CVE-2025-20130 Cisco Identity Services Engine Access Control Bypass Vulnerability

A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy...

CVE-2025-20130

Cisco ISE/ISE-PIC expose an authenticated admin-facing Arbitrary File Upload vulnerability via the API due to improper validation of the file copy function. An admin with network access can send crafted file upload requests to a specific endpoint to upload arbitrary files. Cisco has released upda...

Cisco Identity Services Engine Arbitrary File Upload Vulnerability

A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy...

PT-2025-23818 · Cisco · Cisco Identity Services Engine +1

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description: A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC...

Cisco Identity Services Engine 安全漏洞

Cisco Identity Services Engine Cisco ISE is an environment-aware platform ISE Identity Services Engine from Cisco USA. The platform regulates the network by collecting real-time information from the network, users, and devices, and formulating and enforcing policies accordingly. A security...

Cisco Identity Services Engine (cisco-sa-ise-aws-static-cred-FPMjUcm7)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access...

PT-2025-23997 · Ibm · Ibm Verify Identity Access Digital Credentials

Name of the Vulnerable Software and Affected Versions: IBM Verify Identity Access Digital Credentials version 24.06 Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in...

PT-2025-23998 · Ibm · Ibm Verify Identity Access Digital Credentials

Name of the Vulnerable Software and Affected Versions: IBM Verify Identity Access Digital Credentials version 24.06 Description: The issue allows an authenticated user to crash the service by sending a specially crafted POST request. This could potentially lead to a denial-of-service condition...

Cisco Identity Services Engine（Cisco ISE）和Cisco ISE Passive Identity Connector 访问控制错误漏洞

Cisco Identity Services Engine Cisco ISE and Cisco ISE Passive Identity Connector are both products of Cisco, Inc.Cisco Identity Services Engine is an environment-aware platform ISE Cisco Identity Services Engine is an environment-aware platform ISE. The platform oversees the network by collectin...

PT-2025-23828

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE versions 3.1 through 3.4 Description A vulnerability in the cloud deployments of Cisco Identity Services Engine ISE on Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI could allow...

Cisco Identity Services Engine (cisco-sa-ise-file-upload-P4M8vwXY)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the API of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker with administrative privileges to upload files to an...

Aembit Extends Workload IAM to Microsoft Ecosystem, Securing Hybrid Access for Non-Human Identities

Silver Spring, Maryland, 3rd June 2025, CyberNewsWire...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. An attacker can redirect users to an attacker-controlled site by crafting a valid link that...

ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by Using OAuth-Enhanced Tool Definitions and Policy-Based Access Control

The Model Context Protocol MCP plays a crucial role in extending the capabilities of Large Language Models LLMs by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably Tool Poisoning and Rug Pull...

WSO2多款产品 跨站脚本漏洞

WSO2 API Manager and so on are products of WSO2, Inc.WSO2 API Manager is a set of API lifecycle management solutions.WSO2 Enterprise Integrator is a set of open source hybrid integration platform.WSO2 Identity Server as Key Manager is an WSO2 Identity Server as Key Manager is an identity server. ...

WSO2多款产品 跨站脚本漏洞

WSO2 Identity Server IS and others are products of WSO2, Inc.WSO2 Identity Server is an identity server.WSO2 Enterprise Integrator is an open source hybrid integration platform.WSO2 Open Banking IAM is an identity and access management solution for the Open Banking domain. （WSO2 Open Banking IAM ...

WSO2多款产品 代码问题漏洞

WSO2 Identity Server IS and others are products of WSO2, Inc.WSO2 Identity Server is an identity server.WSO2 Identity Server as Key Manager is an identity server.WSO2 Open Banking IAM is an identity and access management solution for the Open Banking OB space. WSO2 Open Banking IAM is an identity...

FreeBSD : libxml2 -- Use After Free (bd2af307-3e50-11f0-95d4-00a098b42aeb)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd2af307-3e50-11f0-95d4-00a098b42aeb advisory. [email protected] reports: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in...

Incorrect Authorization

Overview org.wso2.is:identity-server-parent is an open source Identity and Access Management solution federating and managing identities across both enterprise and cloud service environments. Affected versions of this package are vulnerable to Incorrect Authorization due to a business logic flaw ...

Cops in Germany Claim They’ve ID’d the Mysterious Trickbot Ransomware Kingpin

The elusive boss of the Trickbot and Conti cybercriminal groups has been known only as “Stern.” Now, German law enforcement has published his alleged identity—and it’s a familiar face...