LinkPlay Sound Bar 信任管理问题漏洞

LinkPlay Sound Bar is a speaker from LinkPlay USA. A trust management issue vulnerability exists in LinkPlay Sound Bar v1.0. An attacker could exploit this vulnerability to elevate privileges via a hard-coded password via an SSL certificate...

Schneider Electric PowerLogic ION Setup 信任管理问题漏洞

Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. Schneider Electric is vulnerable to a trust management issue...

USR IOT 4G LTE Industrial Cellular VPN Router 信任管理问题漏洞

Jinan USR IOT Technology USR IOT 4G LTE Industrial Cellular VPN Router is an industrial-grade 4G wireless LTE router from Jinan USR IOT Technology China. A security vulnerability exists in the USR IOT 4G LTE Industrial Cellular VPN Router version 1.0.36, which originates from the inability to...

Five Steps to Prepare Data for a Zero-Trust Security Model

The outmoding of traditional network security Traditional network security was based on the concept of a guarded network perimeter, which is difficult to access from the outside but implicitly trusts everyone on the inside. The problem with this approach is that once an attacker has access to the...

Dell BSAFE Micro Edition Suite 信任管理问题漏洞

Dell BSAFE Micro Edition Suite is a development kit that provides encryption, certificate, and transport layer security for c/c applications, devices, and systems.Dell BSAFE Micro Edition Suite is vulnerable to a trust management issue that could be exploited by remote attackers to submit special...

Secure access for a connected world—meet Microsoft Entra

What could the world achieve if we had trust in every digital experience and interaction? This question has inspired us to think differently about identity and access, and today, we’re announcing our expanded vision for how we will help provide secure access for our connected world. Microsoft Ent...

Secure access for a connected world—meet Microsoft Entra

What could the world achieve if we had trust in every digital experience and interaction? This question has inspired us to think differently about identity and access, and today, we’re announcing our expanded vision for how we will help provide secure access for our connected world. Microsoft Ent...

TOTOLINK A3100R is vulnerable to trust management issues

The TOTOLINK A3100R is a wireless router. The TOTOLINK A3100R suffers from a trust management issue vulnerability that can be exploited by an attacker to obtain the root password...

Mobaoku-Auction&Flea Market 信任管理问题漏洞

Mobaoku-Auction&Flea Market is a mobile software. Mobaoku-Auction&Flea Market is vulnerable to a trust management issue, which arises from improper server certificate validation. A remote attacker could exploit the vulnerability to eavesdrop on encrypted communications...

The Added Dangers Privileged Accounts Pose to Your Active Directory

In any organization, there are certain accounts that are designated as being privileged. These privileged accounts differ from standard user accounts in that they have permission to perform actions that go beyond what standard users can do. The actions vary based on the nature of the account but...

Argo CD will blindly trust JWT claims if anonymous access is enabled

Impact A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the admin user, by sending a specifically crafted JSON Web Token JWT along with the request. In order for this vulnerability to be exploited...

GHSA-R642-GV9P-2WJJ Argo CD will blindly trust JWT claims if anonymous access is enabled

Impact A critical vulnerability has been discovered in Argo CD which would allow unauthenticated users to impersonate as any Argo CD user or role, including the admin user, by sending a specifically crafted JSON Web Token JWT along with the request. In order for this vulnerability to be exploited...

GO-2022-0171 Mishandled trust preferences for root certificates on Darwin in crypto/x509

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate...

GHSA-3CQM-MF7H-PRRJ Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-CHGW-36XV-47CW OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope trust/oauth/application credential can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially...

How to improve risk management using Zero Trust architecture

“Compliance is all about risk management and lessening risk, and the same is true of Zero Trust.” —Abbas Kudrati Whats risk management and why is it important? Risk management, the process of developing a strategy for addressing risk throughout its lifecycle, normally involves four phases: risk...

Zero Trust for Data Helps Enterprises Detect, Respond and Recover from Breaches

AUTHOR: Mohit Tiwari, CEO and Co-Founder, Symmetry Systems Compromised credentials and identities, third-party breaches, API attacks, and application exploits are all foundational entry points for today’s hackers. Recent months have brought many high-profile breaches from Samsung and Nvidia to Ok...

Rakuten Mobile Rakuten Casa Trust Management Issue Vulnerability

Rakuten Mobile Rakuten Casa is a small base station from Rakuten Mobile Japan, Inc. A trust management issue vulnerability exists in Rakuten Mobile Rakuten Casa APFV200 and APFV141 versions, which stems from the presence of hard-coded credentials in the application code. An unauthenticated, remot...

Pion DTLS 信任管理问题漏洞

Pion DTLS is a Go-based implementation of DTLS Packet Transport Layer Security Protocol. A trust management issue vulnerability exists in Pion DTLS versions prior to 2.1.5, which stems from the fact that a DTLS client can provide a certificate for which it does not own the private key, and Pion...