article thumbnail

CVE-2023-38035: Ivanti Sentry API Authentication Bypass Zero-Day Exploited in the Wild

Tenable

CVE Description CVSSv3 Severity CVE-2023-38035 Ivanti Sentry API Authentication Bypass Vulnerability 9.8 Analysis CVE-2023-38035 is an authentication bypass vulnerability in the MobileIron Configuration Service (MICS) Admin Portal of the Ivanti Sentry System Manager.

article thumbnail

A Reference Architecture for the Cloudera Private Cloud Base Data Platform

Cloudera

Customers will implement firewalls at the perimeter of the cluster, the amount of network traffic and ports used for intra cluster communication is significant. Kerberos is used as the primary authentication method for cluster services composed of individual host roles and also typically for applications. Authorisation.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

CVE-2023-27997: Heap-Based Buffer Overflow in Fortinet FortiOS and FortiProxy SSL-VPN (XORtigate)

Tenable

High CVE-2023-29180 FortiOS Null pointer de-reference in SSLVPNd 7.3 High CVE-2023-29179 FortiOS Null pointer de-reference in SSLVPNd proxy endpoint 6.4 High CVE-2023-29180 FortiOS Null pointer de-reference in SSLVPNd 7.3 High CVE-2023-29179 FortiOS Null pointer de-reference in SSLVPNd proxy endpoint 6.4

Firewall 102
article thumbnail

Rockwell Automation: Disconnect OT Devices with Public-Facing Internet Access, Patch or Mitigate Logix, FactoryTalk CVEs

Tenable

Public facing controllers without security controls, such as those without authentication enabled, may be altered or programmed by a remote attacker possessing the correct software, even without a vulnerability to exploit. Enable multifactor authentication (MFA) on accounts where possible.

article thumbnail

Optimizing PCI compliance in financial institutions

CIO

All other needs, for example, authentication, encryption, log management, system configuration, would be treated the same—by using the architectural patterns available. Some of them not only can provide strong authentication, but also have the ability to be used as a secret repository.

article thumbnail

Are Cloud Serverless Functions Exposing Your Data?

Prisma Clud

Just need a quick reference? Does the site force authentication that we might want to trickle down? publicly accessible network-wise) Require no additional form of authentication (i.e., Does the function require any authentication material or enforce any level of authorization? Already an expert?

article thumbnail

Oracle January 2024 Critical Patch Update Addresses 191 CVEs

Tenable

A full breakdown of the patches for this quarter can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication. Please refer to the January 2024 advisory for full details.

Backup 68