CVE-2022-27225

Gradle Enterprise before 2021.4.3 is affected by a session‑level vulnerability related to Keycloak cookies. During sign‑in, Keycloak sets cookies that effectively enable remember‑me functionality; for older Safari versions, a duplicate cookie is created without the Secure attribute. This allows t...

TerraMaster TOS 访问控制错误漏洞

TerraMaster is a world-renowned professional storage brand. TerraMaster TOS identity bypass vulnerability can be exploited by attackers to gain server privileges...

CVE-2021-41849

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information PII in plaintext using HTTP to servers located in China: user's list of installed apps and device International Mobile Equipment Identity IMEI. This PII is transmitted to...

Remote Command Execution in uploading repository file

Description When uploading a file to the repository in Gogs, the treepath parameter is not been validated. The attacker can set treepath=/.git/ to upload file into the .git directory. Rewrite .git/config file and set core.sshCommand, which leads to remote command execution vulnerability. Proof of...

Luna Simo信息泄露漏洞

Luna Simo is a smartphone from the Korean company Luna. A security vulnerability exists in Luna Simo PPR1.180610.011/202001031830. The vulnerability stems from improper access control, where all third-party applications located on the device can obtain the value of the system IMEI attribute even...

Why decentralization is the future of digital identities

Our identity is increasingly becoming digitized—more of our hard copy credentials are converting into digital formats. We use these digital credentials to work, learn, play, socialize, shop, and consume services online and offline every day. It’s so convenient and expected now to be able to have...

Why decentralization is the future of digital identities

Our identity is increasingly becoming digitized—more of our hard copy credentials are converting into digital formats. We use these digital credentials to work, learn, play, socialize, shop, and consume services online and offline every day. It’s so convenient and expected now to be able to have...

Extortion scheme impersonates government officials, law enforcement

The FBI issued a public warning this week about a fraud scheme wherein scammers impersonate government officials and law enforcement personnel. According to the PSA, the scammers spoof legitimate numbers and names and use fake credentials of well-known members of the government and law enforcemen...

Casdoor SQL Injection (CVE-2022-24124)

On Jan 22, 2022, a high severity SQL Injection vulnerability was reported in Casdoor which affected versions before 1.13.1 release. The vulnerability is tracked as CVE-2022-24124 with CVSS V3 7.5 score has a publicly available simple proof of concept which makes it easier for skilled attackers to...

TerraMaster TOS Identity Bypass Vulnerability

TerraMaster is a world-renowned professional storage brand. TerraMaster TOS identity bypass vulnerability can be exploited by attackers to gain server privileges...

Identity Theft Statistics You Need to Know in 2022

By Waqas Identity theft has become a defining threat in the virtual sphere and with the rate cybercrime is surging… This is a post from HackRead.com Read the original post: Identity Theft Statistics You Need to Know in 2022...

Security Bulletin: Security vulnerability in Apache log4j used by IBM Db2 used by IBM Security Verify Governance, Identity Manager software component (CVE-2021-44228)

Summary A vulnerability exists in Apache log4j, which affects IBM Db2, which in turn is used by IBM Security Verify Governance, Identity Manager software component. Information about the security vulnerability affecting IBM Db2 has been published in a security bulletin. Vulnerability Details Refe...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 used by IBM Security Verify Governance, Identity Manager software component

Summary Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Security Verify...

Microsoft Azure 'AutoWarp' Bug Could Have Let Attackers Access Customers' Accounts

Details have been disclosed about a now-addressed critical vulnerability in Microsoft's Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control. "This attack could mean full control over resources and data belonging to the...

Disclosure of Vulnerability in Azure Automation Managed Identity Tokens

On December 10, 2021, Microsoft mitigated a vulnerability in the Azure Automation service. Azure Automation accounts that used Managed Identities tokens for authorization and an Azure Sandbox for job runtime and execution were exposed. Microsoft has not detected evidence of misuse of tokens...

Disclosure of Vulnerability in Azure Automation Managed Identity Tokens

On December 10, 2021, Microsoft mitigated a vulnerability in the Azure Automation service. Azure Automation accounts that used Managed Identitiestokens for authorization and an Azure Sandbox for job runtime and execution were exposed. Microsoft has not detected evidence of misuse of tokens...

Disclosure of Vulnerability in Azure Automation Managed Identity Tokens

On December 10, 2021, Microsoft mitigated a vulnerability in the Azure Automation service. Azure Automation accounts that used Managed Identitiestokens for authorization and an Azure Sandbox for job runtime and execution were exposed. Microsoft has not detected evidence of misuse of tokens...

Cisco Identity Services Engine RADIUS Service DoS (cisco-sa-ise-dos-JLh9TxBp)

According to its self-reported version, a denial of service DoS vulnerability exists in Cisco Identity Services Engine due to improper handling of RADIUS requests. An unauthenticated, remote attacker can exploit this issue, by sending crafted RADIUS requests, to cause the RADIUS service to stop...

CyberArk Identity Security Feature Issue Vulnerability

CyberArk Identity, a CyberArk company, provides the most complete identity security platform to secure all identities from end-to-end.CyberArk Identity is vulnerable to a security signature issue that stems from the fact that the StartAuthentication resource exposes the response header X-CFY-TX-T...

CVE-2022-22700

CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations, that response header contains different, predictable value ranges which can be used to determine whether a user exists in the tenant...