CVE-2025-6083

In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the ownerid filter. This issue may allow users to search data across the entire table instead of being restricted to their specific ownerid...

Extreme Universal ZTNA 授权问题漏洞

Extreme Universal ZTNA is a complete network access solution from Extreme, Inc. An authorization issue vulnerability exists in Extreme Universal ZTNA that stems from a searchKeyword conditional syntax error that could lead to bypassing the ownerid filter...

Exploit for Link Following in Microsoft

Diffing cleanmgr.exe The new version of cleanmgr.exe inclu...

Beyond Implementation: Building a Zero Trust Strategy That Works

...

Identity and Access Management for the Computing Continuum

The computing continuum introduces new challenges for access control due to its dynamic, distributed, and heterogeneous nature. In this paper, we propose a Zero-Trust ZT access control solution that leverages decentralized identification and authentication mechanisms based on Decentralized...

Cisco Nexus Dashboard Fabric Controller Trust Management Issues Vulnerability

The Cisco Nexus Dashboard Fabric Controller is a comprehensive network management platform from Cisco for managing Cisco NX-OS deployments for LAN, SAN, and IP Fabric for Media IPFM networks in data centers. A trust management issue vulnerability exists in Cisco Nexus Dashboard Fabric Controller...

Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuratio...

Dell PowerStore Trust Management Issues Vulnerabilities

Dell PowerStore is a scalable all-flash array storage from Dell USA. A trust management issue vulnerability exists in Dell PowerStore version 4.0.0.0, which stems from the use of hard-coded credentials and can be exploited by an attacker to cause unauthorized access...

Securing Open RAN: a Survey of Cryptographic Challenges and Emerging Solutions for 5G

The advent of Open Radio Access Networks O-RAN introduces modularity and flexibility into 5G deployments but also surfaces novel security challenges across disaggregated interfaces. This literature review synthesizes recent research across thirteen academic and industry sources, examining...

GFI Archiver 信任管理问题漏洞

GFI Archiver is an e-mail archiving software from GFI, Inc. for protecting, storing and retrieving your electronic communications. GFI Archiver suffers from a trust management issue vulnerability that stems from hard-coding JWT signing keys, which could lead to unauthorized access...

Fortinet FortiClientWindows 安全漏洞

Fortinet FortiClientWindows is a Windows-based mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A trust management issue...

Fortinet FortiOS 信任管理问题漏洞

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A trust management...

Requests vulnerable to .netrc credentials leak via malicious URLs

Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs. References...

ALPINE-CVE-2024-47081

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

AZL-63812 CVE-2024-47081 affecting package python-requests for versions less than 2.27.1-8

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

org.keycloak.protocol.services: Keycloak hostname verification

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended...

Authorino Uncontrolled Resource Consumption vulnerability

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with...

CVE-2025-25207

The CVE concerns Authorino in Red Hat Connectivity Link. A developer-persona attacker can flood the service with post‑authorization callbacks, and since policy enforcement is handled by a single Authorino instance, this leads to Denial of Service during post‑authorization callback processing. Doc...

CVE-2025-25207 Rhcl: authpolicy callbacks result in denial of service in authorino severity

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with...