Security Advisory - Identity Authentication Bypass Vulnerability in The Huawei Children Smart Watch (Simba-AL00)

The Huawei Children Smart Watch Simba-AL00 has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.Vulnerability ID:HWPSIRT-2022-18770 This vulnerability has been assigned a CVE ID:...

The vulnerability of the Command Line Interface (CLI) of the Cisco Identity Services Engine (ISE) management platform allows a hacker to escalate their privileges.

The vulnerability of the Command Line Interface CLI of the Cisco Identity Services Engine ISE management platform relates to the lack of measures taken to neutralize special elements used in the OS command line. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the Command Line Interface (CLI) of the Cisco Identity Services Engine (ISE) management platform allows a hacker to escalate their privileges.

The vulnerability of the Command Line Interface CLI of the Cisco Identity Services Engine ISE management platform relates to the lack of measures taken to neutralize special elements used in the OS command line. Exploiting this vulnerability can allow attackers to increase their privileges...

Security Bulletin: Vulnerabilities in IBM WebSphere Liberty affects IBM InfoSphere Global Name Management (CVE-2022-22475, CVE-2022-22476)

Summary The IBM WebSphere Liberty used in IBM InfoSphere Global Name Management is vulnerable to identity spoofing by an authenticated user. This issue only affects ENS, a part of GNM 6 installed by a small minority of GNM customers. For GNM customers not using ENS, there is no vulnerability...

Tackling the New Cyber Insurance Requirements: Can Your Organization Comply?

With cyberattacks around the world escalating rapidly, insurance companies are ramping up the requirements to qualify for a cyber insurance policy. Ransomware attacks were up 80% last year, prompting underwriters to put in place a number of new provisions designed to prevent ransomware and stem t...

Security Bulletin: IBM Security Verify Governance, Identity Manager software component is affected by a vulnerabilitiy CVE-2023-23477

Summary A vulnerabilitiy has been identified in IBM WebSphere Application Server shipped with IBM Security Verify Governance, Identity Manager software componentCVE-2023-23477 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and...

Multiple people can register the same cidNFTID

Lines of code Vulnerability details Impact Multiple people can register the same cidNFT in a way that the same "canonical on-chain identity" can be shared accross multiple real-life identities. Proof of Concept cidNFTs can be transfered as any ERC721 token. After each transfer the new owner can...

CKAN 安全漏洞

CKAN is an open source Dms data management system. Used to power data centers and data portals. A security vulnerability exists in CKAN versions prior to 5.4.1, which stems from the fact that if a user does not set a custom value via an environment variable in the .env file, a key is shared betwe...

Multiple accounts can have the same identity

Lines of code Vulnerability details Users can register their on-chain identity ie their CID NFT by calling AddressRegistry.register File: src/AddressRegistry.sol 42: function registeruint256 cidNFTID external 43: if ERC721cidNFT.ownerOfcidNFTID != msg.sender 44: // We only guarantee that a CID NF...

Same identity can be assigned to multiple users

Lines of code Vulnerability details Impact In the contest details it is mentioned that identity can be transferable even if it's currently assigned to address in AddressRegistry. However, I would assume that if another address registers it, the identity should be removed from the previous owner...

Cisco Identity Services Engine 操作系统命令注入漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information about the network, users, and devices to formulate and enforce policies to regulate the network. A security vulnerability exists in Cisco Identity...

Cisco Identity Services Engine Privilege Escalation Vulnerabilities (cisco-sa-ise-os-injection-pxhKsDM)

According to its self-reported version, Cisco Identity Services Engine is affected by multiple privilege escalation vulnerabilities that allow an authenticated, local attacker with Administrator privileges to inject commands due to insufficient input validation. Please see the included Cisco BIDs...

Cisco Identity Services Engine 操作系统命令注入漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information about the network, users, and devices to formulate and enforce policies to regulate the network. A security vulnerability exists in Cisco Identity...

Cisco Identity Services Engine XXE Injection (cisco-sa-ise-xxe-inj-GecEHY58)

According to its self-reported version, Cisco Identity Services Engine is affected by a XML external element XXE vulnerability. A remote attacker, authenticated with Super Admin or Proxy Admin credentials can exploit this vulnerability by uploading a crafted XML file that contains references to...

Cisco Identity Services Engine 代码问题漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information from the network, users, and devices to develop and implement policies to monitor the network. A security vulnerability exists in Cisco Identity...

Vulnerabilities fixed in Cisco Identity Services Engine (ISE).

Cisco has fixed vulnerabilities in Identity Services Engine ISE. A malicious person with access to the Web-based management environment could exploit the vulnerabilities to gain access to sensitive data via a Same Server Request Forgery to gain access to sensitive data. It is good practice not to...

Cisco Identity Services Engine 操作系统命令注入漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information about the network, users, and devices to formulate and enforce policies to regulate the network. A security vulnerability exists in Cisco Identity...

Cisco Identity Services Engine Privilege Escalation Vulnerabilities

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

CVE-2023-20021

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

CVE-2023-20023

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...