Security Update for Azure Identity Module (October 2023)

The version of Azure Identity installed on the remote host is prior to 3.3.1. It is, therefore, affected by a remote code execution vulnerability: As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call. The...

Azure Identity Library Installed (Linux/UNIX)

Binary data azureidentitynixinstalled.nbin...

Azure Identity Library Installed (Windows)

Binary data azureidentitywininstalled.nbin...

BD FACSChorus Security Breach

BD FACSChorus is a multichannel flow cytometry system from Bidi Medical BD. A security vulnerability exists in the BD FACSChorus that stems from being configured to allow the transmission of hashed user credentials based on a user action without fully verifying the identity of the requested...

The vulnerability of the Blitz Identity Provider software lies in its ability to redirect URL addresses, allowing a hacker to redirect a user to any arbitrary URL address.

The vulnerability of the Blitz Identity Provider software relates to the possibility of redirecting URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address by sending a specially crafted link...

Control iD iDSecure Security Breach

Control iD iDSecure is an ID security program from Control iD. A security vulnerability exists in Control iD iDSecure version v4.7.32.0. An attacker can bypass authentication by exploiting this vulnerability...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a malicious actor to upload arbitrary files into the application’s root web directory.

The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to upload arbitrary files to the application’s root web directory remotely...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a attacker to execute cross-site scripting attacks.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to load arbitrary files.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load any desired files...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2023-93326)

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. The Cisco Identity Services Engine suffers from...

Cisco Identity Services Engine Arbitrary File Write Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An arbitrary file write vulnerability exists in...

Malwarebytes consumer product roundup: The latest

At Malwarebytes, we’re constantly evolving to protect our customers. These days, our products don’t just protect you from malware, we protect your identity, defend you from ads, safeguard your social media, and keep your mobile safe too. Here are the innovations we’ve made in our products recentl...

Apple to Add Manual Authentication to iMessage

Signal has had the ability to manually authenticate another account for years. iMessage is getting it: The feature is called Contact Key Verification, and it does just what its name says: it lets you add a manual verification step in an iMessage conversation to confirm that the other person is wh...

PYSEC-2023-244

Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.Now we have fixed this issue and now user must have the correct login to access workbench.This issue affects Apache Submarine: from 0.7.0 before 0.8.0.We...

CVE-2023-48228

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

Design/Logic Flaw

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228 OAuth2: PKCE can be fully circumvented

authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....

CVE-2023-48228

CVE-2023-48228 affects the authentik open-source IDP. The vulnerability is in the PKCE code_verifier validation during OAuth2 token exchange: prior to versions 2023.10.4 and 2023.8.5, authentik accepted a token request without verifying the code_verifier even when a code_challenge was used. The i...

CVE-2023-20272

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

CVE-2023-20208

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device...