14993 matches found
Design/Logic Flaw
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority CA, allowing the client to validate th...
Hitachi Energy RTU500 信任管理问题漏洞
RTU500 is a series of industrial control components from Hitachi, Japan, mainly used for industrial control systems.RTU500 Scripting interface is part of Hitachi Energy RTU500 series of industrial control components, mainly used to provide scripting programming interface to realize specific...
Top 7 Trends Shaping SaaS Security in 2024
Over the past few years, SaaS has developed into the backbone of corporate IT. Service businesses, such as medical practices, law firms, and financial services firms, are almost entirely SaaS based. Non-service businesses, including manufacturers and retailers, have about 70% of their software in...
GHSA-F6JM-9PR8-9C3W Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning
Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...
Remote code execution
TAIWAN-CATWCA JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an...
PT-2023-30811 · Unknown · Jcicsecuritytool
Name of the Vulnerable Software and Affected Versions: JCICSecurityTool affected versions not specified Description: The issue arises from the JCICSecurityTool's failure to check the source website and access locations when executing multiple Registry-related functions. If a user, who has complet...
NIST SP 800-53 Rev. 5 Updates: What You Need to Know About The Most Recent Patch Release (5.1.1)
On November 7th, the National Institute of Standards and Technology NIST issued an update to SP 800-53, a NIST-curated catalog of controls that organizations can implement to effectively manage security and privacy risk. In this blog we’ll cover the new and updated controls within patch release...
NIST SP 800-53 Rev. 5 Updates: What You Need to Know About The Most Recent Patch Release (5.1.1)
On November 7th, the National Institute of Standards and Technology NIST issued an update to SP 800-53, a NIST-curated catalog of controls that organizations can implement to effectively manage security and privacy risk. In this blog we’ll cover the new and updated controls within patch release...
Microsoft Busts Black Market for 100s of Millions of Fraudulent Accounts
By Deeba Ahmed The internet's underbelly is thriving on stolen identities and fake accounts, fueling mass phishing campaigns, identity theft rings, and DDoS attacks. This is a post from HackRead.com Read the original post: Microsoft Busts Black Market for 100s of Millions of Fraudulent Accounts...
One Identity Password Manager Kiosk Escape Privilege Escalation
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Kiosk Escape Privilege Escalation product: One Identity Password Manager Secure Password Extension vulnerable version: 5.13.1 fixed version: 5.13.1 CVE number:...
Threat actors misuse OAuth applications to automate financially driven attacks
Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...
Strengthening identity protection in the face of highly sophisticated attacks
The post Strengthening identity protection in the face of highly sophisticated attacks appeared first on Microsoft Security Blog...
Strengthening identity protection in the face of highly sophisticated attacks
The post Strengthening identity protection in the face of highly sophisticated attacks appeared first on Microsoft Security Blog...
The vulnerability of the Cisco Identity Services Engine (ISE) platform, which involves unlimited loading of malicious files, allows a hacker to execute arbitrary code.
The vulnerability of the Cisco Identity Services Engine ISE platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Exploit for Injection in Vm2_Project Vm2
CVE-2023-30547 PoC Exploit for VM2 Sandbox Escape Vulnerabili...
CVE-2022-39222
A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The...
VMware Cloud Director - Bypass identity verification Exploit
CVE-2023-34060 vulnerability is a vulnerability that allows an attacker to bypass identity verification when entering port 22 ssh or port 5480 Device Management Console in VMware Cloud Director Appliance123. This vulnerability does not exist on port 443 VCD provider and tenant sign-in...
Dalmann OCPP.Core Security Vulnerability
Dalmann OCPP.Core is an OCPP Open Charge Point Protocol server written in .NET 6 by Ulrich Personal Developer. A security vulnerability exists in Dalmann OCPP.Core versions prior to 1.3.0 that stems from the server allowing an attacker to conduct multiple transactions using the same connectorId a...
Microsoft Security Copilot drives new product integrations at Microsoft Ignite to empower security and IT teams
First announced in March 2023, Microsoft Security Copilot—Microsofts first generative AI security product—has sparked major interest. The widespread enthusiasm was on full display after announcing our Early Access Program in October 2023 and sharing our incredible Security Copilot innovations at...
Microsoft Security Copilot drives new product integrations at Microsoft Ignite to empower security and IT teams
First announced in March 2023, Microsoft Security Copilot—Microsofts first generative AI security product—has sparked major interest. The widespread enthusiasm was on full display after announcing our Early Access Program in October 2023 and sharing our incredible Security Copilot innovations at...