5 Steps to Establishing a Zero Trust Foundation in the Cloud with Wiz

Gain complete visibility into your environment and its risks to enable a Zero Trust strategy in the cloud...

Gitsign Security Vulnerabilities

Gitsign is a tool for Gitsign individual developers to sign Git commits key-free. A security vulnerability exists in Gitsign version 0.6.0 through versions prior to 0.8.0, which stems from the fact that the Rekor public key is obtained through the Rekor API, not through the local TUF client, and...

CVE-2023-47122: Improper Verification of Cryptographic Signature

Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could...

Implementing Zero Trust: 5 Key Considerations

When implementing a Zero Trust strategy and selecting a solution to safeguard your company against cyber risk, there are many factors to consider. Five key areas include Visibility and Analytics, Automation and Orchestration, Central Management, Analyst Experience, and Pricing Flexibility and...

Rocky Linux 8 : postgresql:10 (RLSA-2022:1830)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1830 advisory. - When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject...

Zoom VDI Meeting Client < 5.13.10 Vulnerability (ZSB-23005)

The version of Zoom VDI Meeting Client installed on the remote host is prior to 5.13.10. It is, therefore, affected by a vulnerability as referenced in the ZSB-23005 advisory. - Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local...

Zoom Client for Meetings < 5.13.5 Vulnerability (ZSB-23005)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.13.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-23005 advisory. - Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local...

What Is Zero Trust Network Access (ZTNA) ?

Unraveling the Mysteries Behind the Zero Trust Network Access ZTNA Paradigm Digital protection strategies have traditionally relied heavily on the concept of trust. However, these conventional notions, which assume a considerable measure of security within an organization's connectivity sphere,...

Squid Trust Management Issues Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in versions prior to Squid 6.4, which stems from incorrect validation of specified ind...

CVE-2023-46248

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

Remote code execution

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

SUSE CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attack...

There is no check for collateral token in mint matches same in withdraw

Lines of code Vulnerability details Impact While we understand that usde is the base token here, we see that on minting used token you would need to transfer some tokens to the contract and get some used minted to you and on redemption get usde burnt to get a token sent back to you. The implicati...

Lack of access control on overrideSanction(), any user can override sanctioned address

Lines of code Vulnerability details Impact Without proper access control, any address can call the overrideSanction function and override the sanction status of an account. This can potentially be exploited by malicious actors to bypass sanctions and carry out unauthorized actions, putting the...

Based on the functionality, if the releaseEscrow() function can be called by unauthorized entities, it can lead to potential misuse or unintended transfer of assets.

Lines of code Vulnerability details Impact The absence of access control on the releaseEscrow function presents a significant security risk. As it currently stands, any external actor or contract can invoke this function, which may result in the unintended release of escrowed funds. This opens up...

What is Zero Trust Architecture (ZTA) ?

Trust No One, Secure Everything: Unpacking Zero Trust Architecture In the ever-evolving landscape of cybersecurity, the traditional approach of building a robust wall around your network and trusting everything inside it is no longer sufficient. The rise of cloud computing, remote work, and mobil...

light-oauth2 Trust Management Issue Vulnerability

light-oauth2 is networknt open source a light-4j based fast , lightweight cloud-native OAuth 2.0 authorization microservice . light-oauth2 version 2.1.27 before the existence of a security vulnerability , the vulnerability stems from obtaining the public key without any validation , allowing an...

Alexander Maier EisBaer Scada Trust Management Issues Vulnerabilities

Alexander Maier EisBaer Scada is a visual reality display and control program created on Windows operating systems by Alexander Maier of Germany. A security vulnerability exists in Alexander Maier EisBaer Scada that stems from the use of hard-coded keys...

Since the build function in 'Vault721' allows anyone to deploy a new ODProxy for any user without proper checks, it creates a potential exploit.

Lines of code Vulnerability details Impact The ability to freely deploy ODProxy contracts through the Vault721 contract's build function represents a significant security vulnerability. Exploitation of this vulnerability could lead to: Unauthorized Actions: Malicious actors could deploy proxies f...

CVE-2022-27813

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the...