14998 matches found
CVE-2023-35016 IBM Security Verify Governance path traversal
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 257772...
CVE-2023-35016
CVE-2023-35016 affects IBM Security Verify Governance, Identity Manager 10.0. A remote attacker could traverse directories by sending a crafted URL with dot-dot sequences (/../) to view arbitrary files. IBM’s security bulletin for the Virtual Appliance lists a fix path: upgrade to 10.0.1 with FP0...
CVE-2023-35019 IBM Security Verify Governance command execution
IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 257873...
CVE-2023-35019
IBM Security Verify Governance, Identity Manager (virtual appliance component) 10.0 is affected by CVE-2023-35019. An authenticated remote attacker could execute arbitrary commands on the system by sending a specially crafted request. The IBM Security bulletin lists a CVSS base score of 7.2 (vect...
PT-2023-25096 · Ibm · Ibm Security Verify Governance
Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance, Identity Manager version 10.0 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially crafted URL request containing "dot dot" sequences /../ to view arbitra...
Nonces are not used in the signature checks
Lines of code Vulnerability details Impact A nonce can prevent an old value from being used when a new value exists. Without one, two transactions submitted in one order, can appear in a block in a different order Transactions on one identity can be replayed on another one. Proof of Concept...
IBM Security Verify Governance 路径遍历漏洞
IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define, and control user access and access risks. A security vulnerability exists in IBM Security Verify Governance, Identity...
Information Disclosure
chef-identity is vulnerable to Information Disclosure. The vulnerability exists because ChefIdentityBuildWrapper.xml does not properly mask the user.pem key on the form field, allowing an attacker to gain sensitive information if they have access to the global configuration file, or are able to...
Cross-Site Scripting (XSS)
github.com/answerdev/answer is vulnerable to Cross-Site Scripting XSS. This flaw enables a malicious user to upload malicious HTML code to the profile page, stealing the identity token as soon as another user or administrator sees the profile page, which allows a different person to assume contro...
GHSA-5JC5-M87X-88FJ Secret displayed without masking by Chef Identity Plugin
Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration. While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form do...
Secret displayed without masking by Chef Identity Plugin
Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration. While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form do...
CVE-2023-39155
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
CVE-2023-39155
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
Design/Logic Flaw
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
CVE-2023-39155
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
CVE-2023-39155
Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it...
CVE-2023-39155
The CVE-2023-39155 entry affects Jenkins Chef Identity Plugin (versions 2.0.3 and earlier). The root cause is that the user.pem key form field in the plugin’s global configuration is not masked, allowing an attacker with access to the Jenkins controller UI to observe or capture the key. This is t...
Jenkins Chef Identity Plugin 安全漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Design/Logic Flaw
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted ...
Cryptojacking: Understanding and defending against cloud compute resource abuse
In cloud environments, cryptojacking – a type of cyberattack that uses computing power to mine cryptocurrency – takes the form of cloud compute resource abuse, which involves a threat actor compromising legitimate tenants. Cloud compute resource abuse could result in financial loss to targeted...