735 matches found
Check Point Security Gateways 安全漏洞
Check Point Security Gateways is an AI-powered NGFW security gateway from Check Point Israel. A security vulnerability exists in Check Point Security Gateways. An attacker could exploit the vulnerability to obtain sensitive information...
VulnCheck KEV: CVE-2024-24919
Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several...
PT-2024-3801
Name of the Vulnerable Software and Affected Versions CloudGuard Network affected versions not specified Quantum Maestro affected versions not specified Quantum Scalable Chassis affected versions not specified Quantum Security Gateways affected versions not specified Quantum Spark Appliances...
Siemens 多款产品 命令注入漏洞
The SICAM 8 power automation platform is a universal, integrated hardware and software-based solution for all applications in the power supply sector.The SICAM A8000 RTU Remote Terminal Unit series is a modular family of devices for remote control and automation applications in all areas of energ...
HPESBNW04640 rev.5 - HPE Aruba Networking Controller and Gateway-Based AOS Multiple Vulnerabilities
Potential Security Impact: Remote: Arbitrary Code Execution, Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Virtual Mobility Controller Software See vulnerability summary for version details. Aruba SD-WAN Software and Gateways See...
CVE-2024-30405
An Incorrect Calculation of Buffer Size vulnerability in Juniper Networks Junos OS SRX 5000 Series devices using SPC2 line cards while ALGs are enabled allows an attacker sending specific crafted packets to cause a transit traffic Denial of Service DoS. Continued receipt and processing of these...
Why it Pays to Have a Comprehensive API Security Strategy
In an era dominated by digital connectivity and rapid technological advancements, Application Programming Interfaces APIs play a pivotal role in facilitating seamless communication and data exchange between diverse software applications. As API usage continues to grow, so does the need for robust...
How Cybercriminals are Exploiting India's UPI for Money Laundering Operations
Cybercriminals are using a network of hired money mules in India using an Android-based application to orchestrate a massive money laundering scheme. The malicious application, called XHelper, is a "key tool for onboarding and managing these money mules," CloudSEK researchers Sparsh Kulshrestha,...
Ivanti Gateways Under Attack by Cybercriminals Patch Now
Summary: Cyber threat actors have been exploiting vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893, which allow them to bypass authentication and execute arbitrary commands with elevated privileges. Despite...
The vulnerability of GlobalProtect Gateways’ operating system, PAN-OS, allows a hacker to establish a VPN connection from an unauthorized IP address.
The vulnerability of GlobalProtect Gateways’ operating system, PAN-OS, is related to insufficient verification of the connection source. Exploiting this vulnerability allows a malicious actor to establish a VPN connection from an unauthorized IP address...
QR Phishing. Fact or Fiction?
October 2023’s Cyber Security Awareness Month led to a flurry of blog posts about a new attack called Quishing QR Code phishing and how new AI powered email gateways can potentially block these attacks. What’s the attack? To understand the attack you need understand the challenge that the attacke...
Imperva defends customers against CVE-2024-22024 in Ivanti products
Ivanti recently published an urgent warning about an authentication bypass in Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways, tracked as CVE-2024-22024. The bug, which carries a severity score of 8.3, was discovered during an internal review. Since its announcement on February 8,...
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
Xxe
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure
Executive Summary: As part of the ongoing investigation, we discovered a new vulnerability as part of our internal review and testing of our code, which was also responsibly disclosed by watchTowr. This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure...
SMTP end-of-data uncertainty can be abused to spoof emails and bypass policies
Overview A vulnerability has been found in the way that SMTP servers and software handle the end-of-data sequences essentially the end of a single email message in mail messages. An attacker can use this inconsistency to craft an email message that can bypass SMTP security policies. Description...
Dual Zero-Day Threats in Ivanti Connect Secure and Policy Secure Gateways – CVE-2023-46805 and CVE-2024-21887
In recent and alarming cybersecurity developments, Volexity researchers have discovered that attackers are exploiting two distinct zero-day vulnerabilities in a coordinated manner to enable unauthenticated remote code execution RCE. These vulnerabilities are identified as CVE-2023-46805 and...
Act now! Ivanti vulnerabilities are being actively exploited
Software vendor Ivanti has warned customers about two actively exploited vulnerabilities in all supported versions of Ivanti Connect Secure and Ivanti Policy Secure Gateways. Successful exploitation would give an attacker the ability to run arbitrary code on Ivantis Virtual Private Network VPN...
Sierra Wireless ALEOS Cross-Site Scripting Vulnerability
Sierra Wireless ALEOS AAF is a framework for creating applications in Sierra Wireless AirLink gateways from Sierra Wireless Canada. Sierra Wireless ALEOS ALEOS 4.16 and prior versions have a cross-site scripting vulnerability that stems from the presence of a stored cross-site scripting XSS...