CVE-2024-31489

AAn improper certificate validation vulnerability CWE-295 in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a...

Fortinet FortiClient 信任管理问题漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. Fortinet FortiClient is vulnerable to a trust...

Dell InsightIQ 信任管理问题漏洞

Dell InsightIQ is a performance monitoring and reporting tool from Dell USA. Dell InsightIQ suffers from a trust management issue vulnerability that stems from the use of hard-coded credentials. Exploitation of this vulnerability by a highly privileged attacker with local access could lead to...

TOTOLINK AC1200 安全漏洞

The TOTOLINK AC1200 T8 is a dual-band full gigabit router from China's Gion Electronics TOTOLINK. The TOTOLINK AC1200 T8 suffers from a trust management issue vulnerability that stems from unknown code in the /etc/shadow.sample file that uses hard-coded passwords. An attacker could exploit the...

My Journey To CTO for Imperva App Sec

I’m delighted to be announcing that I’ve joined Imperva as the CTO for Application Security. Many of you readers know me as the Forrester analyst covering Zero Trust, SASE, and network security since before the pandemic. But what you might not have known is prior to that, I was in application...

QNAP QuMagie 信任管理问题漏洞

QNAP Systems QuMagie is a QTS photo management application from China Weilian Technology QNAP Systems. A trust management issue vulnerability exists in QNAP QuMagie version 2.3.1 and prior versions, which stems from the inclusion of an incorrect certificate validation vulnerability. An attacker w...

Cisco Smart Licensing Utility 信任管理问题漏洞

Cisco Smart Licensing Utility CSLU is a Cisco application that allows customers to manage licenses and associated product instances from their local location. A trust management issue vulnerability exists in Cisco Smart Licensing Utility that stems from an undocumented static administrator...

How to Implement Zero Trust on a Budget

...

IBM MaaS360 Trust Management Issue Vulnerability

IBM MaaS360 is a suite of enterprise mobile device management solutions from International Business Machines IBM. The solution provides end-to-end security and management of mobile devices, documents, applications and email. A trust management issue vulnerability exists in IBM MaaS360 versions 6....

(0Day) Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration o...

IBM MaaS360 信任管理问题漏洞

IBM MaaS360 is a suite of enterprise mobile device management solutions from International Business Machines IBM. The solution provides end-to-end security and management of mobile devices, documents, applications and email. A trust management issue vulnerability exists in IBM MaaS360 versions 6....

PT-2024-31308 · Serilog · Serilog

Name of the Vulnerable Software and Affected Versions: Serilog versions prior to 2.1.0 Description: The issue allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. This enables attackers to...

TOTOLINK AC1200 Trust Management Issue Vulnerability

TOTOLINK AC1200 is a dual-band Wi-Fi router from China's Gion Electronics TOTOLINK. The TOTOLINK AC1200 version 4.1.8cu.5207 suffers from a trust management issue vulnerability that originates from an unknown function in the Telnet service component with hard-coded credentials in the file...

NULL Pointer Dereference

Fort is vulnerable to NULL Pointer Dereference. The vulnerability is caused due a malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. When compiled wi...

Buffer Overflow

Fort is vulnerable to Buffer Overflow. The vulnerability is caused due to a malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into...

NULL Pointer Dereference

Fort is vulnerable to NULL Pointer Dereference. The vulnerability is caused due to a malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field which For...

FileCatalyst Workflow 信任管理问题漏洞

FileCatalyst Workflow is a browser-based large file transfer solution from FileCatalyst, Inc. A security vulnerability exists in FileCatalyst Workflow that stems from the use of default credentials has been posted in the Vendor Knowledge Base article...

CVE-2024-45234

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP an ROA or a Manifest containing a signedAttrs encoded in non-canonical form. This bypasses Fort's BER decoder, reaching a point in the code that panics...

CVE-2024-45239

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP an ROA or a Manifest containing a null eContent field. Fort dereferences the pointer without sanitizing it first. Because Fort is an RPKI Relying Party, ...

CVE-2024-45235

An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing an Authority Key Identifier extension that lacks the keyIdentifier field. Fort references this pointer without sanitizi...