14116 matches found
CVE-2024-47909
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service...
CVE-2024-47907
A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service...
CVE-2024-47907
A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service...
CVE-2024-47907
CVE-2024-47907 describes a stack-based buffer overflow in the IPsec component of Ivanti Connect Secure, before version 22.7R2.3, allowing a remote unauthenticated attacker to cause a denial of service. Affected product: Ivanti Connect Secure (ICS). Connected sources consistently confirm the issue...
CVE-2024-47906
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.2 Not Applicable to 9.1Rx allows a local authenticated attacker to escalate privileges...
CVE-2024-47906
CVE-2024-47906 : Excessive binary privileges in Ivanti Connect Secure (ICS) before 22.7R2.3 and Ivanti Policy Secure (IPS) before 22.7R1.2 allow a local authenticated attacker to escalate privileges. Not applicable to 9.1Rx. Connected advisories confirm affected versions and provide explicit fixe...
CVE-2024-47906
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.2 Not Applicable to 9.1Rx allows a local authenticated attacker to escalate privileges...
CVE-2024-9420
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution...
CVE-2024-9420
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution...
CVE-2024-9420
CVE-2024-9420 is a use-after-free vulnerability affecting Ivanti Connect Secure prior to 22.7R2.3 and 9.1R18.9, and Ivanti Policy Secure prior to 22.7R1.2. The issue allows a remote authenticated attacker to achieve remote code execution. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C...
CVE-2024-47905
CVE-2024-47905 describes a stack-based buffer overflow in Ivanti Connect Secure prior to 22.7R2.3 and Ivanti Policy Secure prior to 22.7R1.2. The vulnerability allows a remote authenticated attacker with admin privileges to cause a denial of service. Public sources confirm affected products and f...
CVE-2024-47905
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service...
CVE-2024-47905
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service...
Ivanti Releases Security Updates for Multiple Products
Ivanti released security updates to address vulnerabilities in Ivanti Endpoint Manager EPM, Ivanti Avalanche, Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Security Access Client. CISA encourages users and administrators to review the following Ivanti security advisories and apply the...
kernel: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
CVE-2024-35840 is a vulnerability in the Linux kernel’s Multipath TCP MPTCP implementation. It occurs because the subflowfinishconnect function may handle uninitialized data in certain fields if a specific MPTCP option OPTIONMPTCPMPJSYNACK is not correctly set during option parsing. This could le...
mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies
A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the modauthopenidcsessionchunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacke...
Moderate: Red Hat Security Advisory: mod_auth_openidc security update
An update for modauthopenidc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
[BSA-120] Security Update for mosquitto
Philippe Coval uploaded new packages for mosquitto which fixed the following security problems: CVE-2024-8376 In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT",...
