nodejs: Improper handling of URI Subject Alternative Names

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

IBM InfoSphere Information Server Cross-Site Request Forgery Vulnerability

IBM InfoSphere Information Server is a data integration platform from International Business Machines Corporation IBM. IBM InfoSphere Information Server version 11.7 contains a cross-site request forgery CSRF vulnerability that could be exploited by an attacker to perform malicious and unauthoriz...

kernel security, bug fix, and enhancement update

5.14.0-70.30.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.30.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

Cross site scripting

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."...

CVE-2022-30615

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592...

CVE-2022-35642

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."...

Cannot complete your request on Gateway URL after adding new domain to trusted domains

After adding a trusted domain to Storefront. when you go to "Manage Authentication Methods", click on the settings, click on "Configure trusted Domains" and add new domains, when users try to go to the gateway URL, you may get either "Login Expired" or "Cannot Complete your Request|" error messag...

CVE-2022-3786

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate...

CISA Upgrades to TLP 2.0

Today, CISA officially upgraded to Traffic Light Protocol TLP 2.0, which facilitates greater information sharing and collaboration. CISA made this upgrade in accordance with the recommendation from the Forum of Incident Response and Security Teams to upgrade to TLP 2.0 by January 2023. Key TLP 2....

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

CVE-2022-3512

CVE-2022-3512 affects Cloudflare WARP by allowing a user to disconnect the WARP client and bypass the Lock WARP switch using the warp-cli add-trusted-ssid command, enabling Zero Trust policies not to be enforced on the endpoint. The available sources consistently describe the bypass vector and it...

CVE-2022-3512

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare WARP Zero Trust Secure Web Gateway, which stems from an attacker's ability to disconnect the WARP client and bypass the "lock WAR...

PT-2022-22585 · Warp · Warp

Name of the Vulnerable Software and Affected Versions: WARP affected versions not specified Description: The issue allows a user to disconnect the WARP client and bypass the "Lock WARP switch" feature by using the warp-cli command "add-trusted-ssid". This results in Zero Trust policies not being...

Error connecting to PVS Farm with Credentials from trusted domain using Selective Trust

When connecting to the PVS Farm "localhost" with credentials from a trusted domain, an error is thrown that reads: "Error Domain Controller" and "unable to connect to the domain Controller if any or the default rootDSE. Error code: 60075030, message: Access is denied Exception from HRESULT:...

keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. There is a security vulnerability in Keylime, there is no information about this vulnerability yet, please stay tuned to CNNVD or the vendor announcement...

CVE-2022-39286 Execution with Unnecessary Privileges in JupyterApp

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in CWD. This vulnerability allows one user to run code as...

nodejs: Certificate Verification Bypass via String Injection

It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host...