Security Bulletin: IBM WebSphere Application Server, used in IBM Security Verify Governance Identity Manager, could provide weaker than expected security (CVE-2023-35890)

Summary IBM Security Verify Governance - Identity Manager uses IBM WebSphere Application Server. The fix includes upgrading IBM WebSphere Application Server with the security patch. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Tampa General Hospital half thwarts ransomware attack, but still loses patient data

The Tampa General Hospital TGH has promised to reach out to individuals whose information has been stolen by a ransomware group. In a cybersecurity notice, TGH said it noticed unusual activity on its computer systems on May 31, 2023. "Fortunately, TGHs monitoring systems and experienced technolog...

PT-2023-12751 · Unknown · Tetra Ta61

Name of the Vulnerable Software and Affected Versions: TETRA TA61 affected versions not specified Description: The TETRA TA61 identity encryption function uses a 64-bit value derived from the SCK Class 2 networks or CCK Class 3 networks. This structure allows for efficient recovery of the 64-bit...

New Microsoft identity and data security capabilities to accelerate CMMC compliance for the Defense Industrial Base

As Department of Defense DoD Chief Information Officer Hon. John Sherman said recently, Cybersecurity Maturity Model Certification CMMC is necessary to ensure that the United States raises the bar for protecting sensitive information.1 The DoD is leading by example towards this goal by implementi...

HPESBMU04496 rev.1 - HPE IceWall Identity Manager, Denial Of Service (DOS)

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall Identity Manager 5.0 RHEL and HP-UX and 6.0 RHEL and Windows - using Apache Commons FileUpload CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

Oracle Identity Manager (Jul 2023 CPU)

The version of Oracle Identity Manager installed on the remote host is missing a security patch and is, therefore affected by multiple vulnerabilities as referenced in the July 2023 Critical Patch UpdateCPU advisory. - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlewa...

Commentary on the Implementation Plan for the 2023 US National Cybersecurity Strategy

The Atlantic Council released a detailed commentary on the White Houses new "Implementation Plan for the 2023 US National Cybersecurity Strategy." Lots of interesting bits. So far, at least three trends emerge: First, the plan contains a somewhat more concrete list of actions than its parent...

CISA and NSA Issue New Guidance to Strengthen 5G Network Slicing Against Threats

U.S. cybersecurity and intelligence agencies have released a set of recommendations to address security concerns with 5G standalone network slicing and harden them against possible threats. "The threat landscape in 5G is dynamic; due to this, advanced monitoring, auditing, and other analytical...

Security Bulletin: InfoSphere Identity Insight is vulnerable to a denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary InfoSphere Identity Insight includes IBM WebSphere Application Server Liberty, which has a vulnerability in the Apache Commons FileUpload when servlet-3.0 feature is enabled. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Malicious code in identity-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51996f6a2e2b1701e5670d8d169328ec0089179efef72ac9d2473f87ca47adf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-514 Malicious code in identity-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51996f6a2e2b1701e5670d8d169328ec0089179efef72ac9d2473f87ca47adf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-21257

creationtimestamp| type| source ---|---|--- 2023-07-13 07:45:23+00:00| seen| https://t.me/cibsecurity/66623...

How a Cloud Flaw Gave Chinese Spies a Key to Microsoft’s Kingdom

Microsoft says hackers somehow stole a cryptographic key, perhaps from its own network, that let them forge user identities and slip past cloud defenses...

SuiteCRM Cross-Site Request Forgery Vulnerability (CNVD-2023-58824)

SuiteCRM is an open source enterprise-level customer relationship management CRM software application. A cross-site request forgery vulnerability exists in SuiteCRM versions prior to 8.3.1, which can be exploited by an attacker to spoof a user's identity and send malicious requests...

Debian dla-3494 : ruby-doorkeeper - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3494 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3494-1 [email protected] https://www.debian.org/lts/security/...

GHSA-25C8-P796-JG6R Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 2.1 and above. This advisory also provides guidance on what developers can do to upda...

Authentication flaw

SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, perfor...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords. Remediation Upgrade...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass. A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords. Remediation Upgrade...

SAP NetWeaver Process Integration 访问控制错误漏洞

SAP NetWeaver Process Integration PI is an SAP enterprise application integration software from SAP, Germany, and is a component of the NetWeaver product group. The component is primarily used for the exchange of information between internal systems and external ones. An access control error...