CVE-2023-32312

The CVE-2023-32312 entry concerns UmbracoIdentityExtensions, an Umbraco add-on for ASP.NET Identity integration. Affected versions expose endpoints to untrusted actors because client secrets are not required, enabling unsafe use of the implicit flow in non-SPA/multi-page scenarios. The root cause...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

Exploit for SQL Injection in Progress Moveit_Cloud

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfe...

PT-2023-23722 · Umbraco · Umbracoidentityextensions

Name of the Vulnerable Software and Affected Versions: UmbracoIdentityExtensions versions affected versions not specified Description: The issue concerns the UmbracoIdentityExtensions package, which is an Umbraco add-on for ASP.Net Identity integration. In affected versions, client secrets are no...

Detect and Prioritize Identity-Related Cloud Risk with InsightCloudSec

In modern cloud environments, roles and permissions are assigned not just to human users, but to machines, resources and services, as well. The massive scale of cloud environments leads to teams potentially managing millions of distinct identities. As a result, security teams often struggle to...

Detecting and mitigating a multi-stage AiTM phishing and BEC campaign

Microsoft Defender Experts uncovered a multi-stage adversary-in-the-middle AiTM phishing and business email compromise BEC attack against banking and financial services organizations. The attack originated from a compromised trusted vendor and transitioned into a series of AiTM attacks and...

Join our digital event to learn what’s new in Microsoft Entra

Editors note 6/15/2023: This blog has been updated to reflect the new date for this event, which is now July 11, 2023. It was previously scheduled for June 20, 2023. In today’s interconnected world, there’s virtually no limit to what technology can help us achieve. Millions of connections happen...

Join our digital event to learn what’s new in Microsoft Entra

Editors note 6/15/2023: This blog has been updated to reflect the new date for this event, which is now July 11, 2023. It was previously scheduled for June 20, 2023. In today’s interconnected world, there’s virtually no limit to what technology can help us achieve. Millions of connections happen...

The vulnerability of the VMware Workspace One Access application management platform, related to the administration console of VMware Identity Manager (vIDM), involves redirecting URLs to an unreliable website. This allows a malicious user to redirect users to any arbitrary URL address.

The vulnerability of the VMware Workspace One Access application management platform, as well as the VMware Identity Manager administration consoles, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to redirect...

Cisco Identity Services Engine 3.1.x < 3.1P6, 3.2.x < 3.2P2 Arbitrary File Delete and File Read (cisco-sa-ise-file-delete-read-PK5ghDDd)

According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from an application identity verification laxity vulnerability in Huawei's pre-authorization...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from an application identity verification laxity vulnerability in Huawei's pre-authorization...

The vulnerability of the administration portal of Cisco Identity Services Engine (ISE) allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco Identity Services Engine ISE administration portal is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the External RESTful Services interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to execute cross-site scripting attacks.

The vulnerability of the External RESTful Services interface of the Cisco Identity Services Engine ISE management platform for network policies relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to execute cross-site scripting attacks.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Vulnerability fixed in VMWare Workspace ONE and Identity Manager

VMWare has fixed a vulnerability in Workspace ONE and Identity Manager vIDM. A malicious party could exploit it for a redirect attack, thus tricking the victim into trick the victim into contacting a server under its own control. This may allow the malicious party to obtain login credentials and...

XDR meets IAM: Comprehensive identity threat detection and response with Microsoft

Identity has become the corporate security perimeter. The average organization used 130 different cloud applications in 2022. That’s up 18 percent from 2021 alone.1 And as organizations continue to embrace digital transformation and enable remote work, they look to identity and access management...

XDR meets IAM: Comprehensive identity threat detection and response with Microsoft

Identity has become the corporate security perimeter. The average organization used 130 different cloud applications in 2022. That’s up 18 percent from 2021 alone.1 And as organizations continue to embrace digital transformation and enable remote work, they look to identity and access management...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to spoofing when using Web Server Plug-ins

Summary IBM Security Verify Governance uses IBM WebSphere Application Server .The fix includes upgrading IBM WebSphere Application Server with the security patch. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: IBM Security Verify Governance, Identity Manager software component ships IBM WebSphere Application Server, which is vulnerable to cross site scripting

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Verify Governance, Identity Manager software component SVGSS. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to t...