EcoStruxure Geo SCADA Expert 信任管理问题漏洞

EcoStruxure Geo SCADA Expert is an integrated, scalable, and reliable supervisory control and data acquisition SCADA software A trust management issue vulnerability exists in EcoStruxure Geo SCADA Expert that stems from a possible man-in-the-middle attack when communication between a client and t...

Shadow Credentials

Microsoft has introduced Windows Hello for Business WHfB to replace traditional password based authentication with a key based trust model. This implementation uses PIN or… Continue reading - Shadow Credentials...

Shadow Credentials

Microsoft has introduced Windows Hello for Business WHfB to replace traditional password based authentication with a key based trust model. This implementation uses PIN or… Continue reading - Shadow Credentials...

Schneider Electric Modicon Controllers Trust Boundary Violation (CVE-2018-7846)

A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller. This plugi...

GHSA-Q5RX-8C2H-5Q7J Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

tokenOut is only required on finalize

Lines of code Vulnerability details Impact I thought of a potential rug pull from the owner: when users buy tokenOut, it is not required that the contract has already escrowed enough tokenOut. It is only required when finalizing the sale: require tokenOut.balanceOfaddressthis = totalTokenOutBough...

Users should be allowed to control accepted tokenOutPrice

Lines of code Vulnerability details Impact Users should be able to control the accepted price. The owner can anytime invoke function setTokenOutPrice and thus change the ratio of token in/out. Users have to trust the owner not to front-run them and make the tokens more expensive. Recommended...

CVE-2021-36152

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

Design/Logic Flaw

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

CVE-2021-36152

CVE-2021-36152 affects Apache Gobblin (Gobblin-as-a-Service) by using an insecure TrustManager that trusts all certificates for LDAP connections. Versions ≤ 0.15.0 are impacted; upgrading to 0.16.0 addresses the issue. No exploitation details are provided in the documents.

CVE-2021-36152: Undefined Security Weakness

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

GitLab Enterprise Edition 和 Gitlab Community Edition 信任管理问题漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. GitLab Enterprise Edition and Gitlab Community Edition are vulnerable to a trust management issue that arises from incorrect certificate validation of external...

Keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. There is a security vulnerability in Keylime, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. There is a security vulnerability in Keylime, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. There is a security vulnerability in Keylime, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Cisco Small Business 信任管理问题漏洞

Cisco Small Business is a switch from Cisco. A trust management issue vulnerability exists in the Cisco Small Business RV Series Routers, which arises from improper validation of software images installed on affected devices. An attacker could exploit this vulnerability by loading unsigned softwa...

Apache Gobblin 信任管理问题漏洞

Apache Gobblin is a distributed data integration framework from the Apache Foundation USA. Used to simplify common aspects of big data integration, Apache Gobblin is vulnerable to a trust management issue that stems from Apache Gobblin trusting all certificates used for LDAP connections in...

How to Use Zero Trust Security for the Hybrid Cloud

Securing the hybrid cloud can be complex. Explore how CISOs can use the zero trust security approach for more proactive protection...

MAX_SHORTFALL_WITHDRAW limit on BTP extraction is not enforced

Handle gellej Vulnerability details Impact The function extractTokensForCollateralShortfall allows the owner of the sNote contract to withdraw up to 50% of the total amount of BPT. Presumably, this 50% limit is in place to prevent the owner from "rug-pulling" the sNote holders or at least to give...