Arbitrary file deletion

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller use...

CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller use...

CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller use...

Cisco Identity Services Engine Vulnerabilities

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload malicious files to the web root of the application or conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. To...

MAL-2023-8516 Malicious code in ext-frontend-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23a7d0539d44404b1c2e340d011eaa58dcad96a27d7d6aef90736d641da7ce39 The OpenSSF Package Analysis project identified 'ext-frontend-identity' @ 7.1.1-develop.9 npm as malicious. It is considered malicious because: ...

Malicious code in ext-frontend-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23a7d0539d44404b1c2e340d011eaa58dcad96a27d7d6aef90736d641da7ce39 The OpenSSF Package Analysis project identified 'ext-frontend-identity' @ 7.1.1-develop.9 npm as malicious. It is considered malicious because: ...

PT-2023-7110 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine affected versions not specified Description: The issue is related to insufficient file input validation in the web-based management interface, allowing an authenticated, remote attacker to upload malicious files...

PT-2023-30741

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.24.0 Description The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. If subject identity verification required is set to Tru...

PT-2023-7111 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to a lack of protection for the web page structure in the Cisco ISE web-based management interface, allowing for a potential cross-site...

State of Maine data breach impacts 1.3 million people

The US State of Maine says it has suffered a data breach impacting around 1.3 million people. According to the census from July 2022, thats more or less the the entire population of Maine. The State of Maine says it was compromised via a known vulnerability in secure transfer service MOVEit...

Top 5 Marketing Tech SaaS Security Challenges

Effective marketing operations today are driven by the use of Software-as-a-Service SaaS applications. Marketing apps such as Salesforce, Hubspot, Outreach, Asana, Monday, and Box empower marketing teams, agencies, freelancers, and subject matter experts to collaborate seamlessly on campaigns and...

SAP NetWeaver AS Java Logon Security Vulnerability

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also is the basic platform for SAP software. A security vulnerability exists in SAP NetWeaver AS Java Logon version 7.50. An attacker could use this vulnerability to brute-force the login...

VulnCheck KEV: CVE-2022-31656

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

It’s Still Easy for Anyone to Become You at Experian

In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly h...

The vulnerability of the Identity Manager software component, used for managing and controlling access to corporate resources and IBM Security Verify Governance applications, allows a perpetrator to gain access to confidential information.

The vulnerability of the Identity Manager software component, which is used for managing and controlling access to corporate resources and applications in IBM Security Verify Governance, is related to the use of weak cryptographic algorithms. Exploiting this vulnerability could allow a malicious...

The vulnerability of the Identity Manager software component, used for managing and controlling access to corporate resources and IBM Security Verify Governance applications, allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the Identity Manager software component, which is used for managing and controlling access to corporate resources and applications in IBM Security Verify Governance, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious...

The vulnerability of the NMI component of the authentication management software in Kubernetes clusters – AAD Pod Identity – involves bypassing the verification token, allowing attackers to elevate their privileges.

The vulnerability of the NMI component in the Kubernetes AAD Pod Identity authentication management tool is related to errors in token assignment restrictions. Exploiting this vulnerability can allow attackers to increase their privileges...

Improper Certificate Validation

io.undertow:undertow-core is vulnerable to Improper Certificate Validation. The vulnerability is due to missing certificate validation in the Http2ClientProvider class to check if the identity is presented by the server certificate in HTTPS connections. If the ENDPOINTIDENTIFICATIONALGORITHM is n...

Malvertiser copies PC news site to deliver infostealer

The majority of malvertising campaigns delivering malicious utilities that we have tracked so far typically deceive victims with pages that are almost the exact replica of the software vendor being impersonated. For example, we have seen fake websites appearing like the real Webex, AnyDesk or...

CVE-2023-47111 ZITADEL race condition in lockout policy execution

ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a Lockout Policy with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is compared against the configured maximum. Exceeding the limit...