Tenable信任管理问题漏洞

Tenable Network Security Tenable.Sc is a vulnerability analysis solution from Tenable Network Security, USA. Sc is a vulnerability analysis solution from Tenable Network Security, Inc. that supports real-time vulnerability assessment and management. A security vulnerability exists in Tenable, whi...

Hashicorp Nomad 信任管理问题漏洞

Hashicorp Nomad is a distributed, data center-aware cluster and application scheduler from Hashicorp, USA. The program supports the deployment of microservices, batch, containerized and non-containerized applications. Hashicorp Nomad suffers from a trust management issue vulnerability that stems...

New Passwordless Verification API Uses SIM Security for Zero Trust Remote Access

Forget watercooler conspiracies or boardroom battles. There's a new war in the office. As companies nudge their staff to return to communal workspaces, many workers don't actually want to – more than 50 percent of employees would rather quit, according to research by EY. While HR teams worry over...

Stack consumption in trust-dns-server

There's a stack overflow leading to a crash and potential DOS when processing additional records for return of MX or SRV record types from the server. This is only possible when a zone is configured with a null target for MX or SRV records. Prior to 0.16.0 the additional record processing was not...

GHSA-4CWW-F7W5-X525 Stack consumption in trust-dns-server

There's a stack overflow leading to a crash and potential DOS when processing additional records for return of MX or SRV record types from the server. This is only possible when a zone is configured with a null target for MX or SRV records. Prior to 0.16.0 the additional record processing was not...

GHSA-369H-PJR2-6WRH Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

actix (>=0.5.0, <=0.5.8), actix-ogn (0.1.0) +12 more potentially affected by CVE-2018-20994 via trust-dns-proto (>=0.2.0, <=0.3.3)

trust-dns-proto CARGO version =0.2.0, =0.5.0, =1.4.0, =0.2.0, =0.1.0, =0.11.0, =0.7.0, =0.2.2, =0.7.0, =0.8.2 - zicsv-tool 0.1.0 Source cves: CVE-2018-20994 Source advisory: OSV:GHSA-369H-PJR2-6WRH...

Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression RFC1035 section 4.1.4. The parser could be tricked into infinite loop when a compression offset pointed back to th...

Improper Certificate Validation in security-framework

If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check...

ARM mbed TLS Trust Management Issue Vulnerability

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. ARM mbed TLS has a security vulnerability that stems from the fact that the null algorithm parameter term is the same as the real array of size 0 and therefore the certificate is considered...

python: ftplib should not use the host from the PASV response

A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecti...

How Vodafone Global Security Director creates an inclusive and secure workplace

Moving to more flexible remote work policies has caused telecommunications giant Vodafone to rethink cybersecurity and the potential friction to users. Instead of relying on physical security controls in the office, the company has embraced a Zero Trust strategy that requires authenticating...

How Vodafone Global Security Director creates an inclusive and secure workplace

Moving to more flexible remote work policies has caused telecommunications giant Vodafone to rethink cybersecurity and the potential friction to users. Instead of relying on physical security controls in the office, the company has embraced a Zero Trust strategy that requires authenticating...

ARM mbed TLS 信任管理问题漏洞

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. ARM mbed TLS has a security vulnerability that stems from the fact that the null algorithm parameter term is the same as the real array of size 0 and therefore the certificate is considered...

libgd 信任管理问题漏洞

libgd is an open source library for dynamically creating images that supports the creation of charts, graphs, thumbnails, etc. by Thomas Boutell, an individual developer in the United States. A trust management issue vulnerability exists in libgd, which stems from the fact that in GNOME libgda...

Icinga 信任管理问题漏洞

Icinga is a scalable server, network resource monitoring system from Icinga, Germany. Icinga suffers from a trust management issue vulnerability that stems from instances of the application connecting to any of the mentioned time-series databases via spoofable infrastructure using TLS...

Microsoft and NIST collaborate on EO to drive Zero Trust adoption

2020s Nobelium attack sent shock waves through both government and private sectors. 2021 has already seen large-scale nation-state attacks such as Hafnium1 alongside major ransomware attacks2 on critical infrastructure. The breadth and boldness of these attacks show that, far from being deterred,...

Microsoft and NIST collaborate on EO to drive Zero Trust adoption

2020s Nobelium attack sent shock waves through both government and private sectors. 2021 has already seen large-scale nation-state attacks such as Hafnium1 alongside major ransomware attacks2 on critical infrastructure. The breadth and boldness of these attacks show that, far from being deterred,...

VulnCheck KEV: CVE-2011-1823

The vold volume manager daemon in Android kernel trusts messages from a PFNETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor...

Tecknodreams SapphireIMS Trust Management Issue Vulnerability

Tecknodreams SapphireIMS is an ITIL 2011 certified enterprise-class service management system from Tecknodreams India.A trust management issue vulnerability exists in SapphireIMS 5.0, which stems from the fact that in SapphireIMS 5.0, it is possible to use hard-coded credentials in the client...