726 matches found
Ivanti Connect Secure和Ivanti Policy Secure 缓冲区错误漏洞
Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. A security vulnerability exists in Ivanti Connect Secure version 9.x,...
Ivanti Connect Secure和Ivanti Policy Secure 代码问题漏洞
Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. A security vulnerability exists in Ivanti Connect Secure version 9.x,...
The vulnerability of the IPSec components of Ivanti Connect Secure and Ivanti Policy Secure network access control tools allows a perpetrator to trigger a service failure or execute arbitrary code.
The vulnerability of the IPSec components of Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to the possibility of buffer overflow attacks. Exploiting this vulnerability could allow a malicious actor to trigger service failures or execute arbitrary code by...
PT-2024-2933 · Ivanti · Ivanti Policy Secure +1
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions 9.x through 22.x Ivanti Policy Secure affected versions not specified Description: A null pointer dereference vulnerability in the IPSec component allows an unauthenticated malicious user to send specially craft...
Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure Gateways
Ivanti has fixed vulnerabilities in Ivanti Connect Secure and Policy Secure. The vulnerabilities allow an unauthenticated malicious party able to remotely perform a Denial of Service execution. For CVE-2024-21894, Ivanti indicates that in certain circumstances could potentially lead to the...
Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities (CVE-2024-21894)
The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities: - A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially...
SA:CVE-2024-21894 (Heap Overflow), CVE-2024-22052 (Null Pointer Dereference), CVE-2024-22053 (Heap Overflow), CVE-2024-22023 (XML entity expansion or XXE) and CVE-2024-29205 for Ivanti Connect Secure and Ivanti Policy Secure Gateways
Last Modified Date Apr 19, 2024 4:08:19 PM...
PT-2024-2564 · Ivanti · Ivanti Policy Secure +1
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions 9.x through 22.x Ivanti Policy Secure versions 9.x through 22.x Description: A heap overflow vulnerability in the IPSec component of Ivanti Connect Secure and Ivanti Policy Secure allows an unauthenticated...
Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT
A financially motivated threat actor called Magnet Goblin is swiftly adopting one-day security vulnerabilities into its arsenal in order to opportunistically breach edge devices and public-facing services and deploy malware on compromised hosts. "Threat actor group Magnet Goblin's hallmark is its...
VulnCheck KEV: CVE-2024-21888
A privilege escalation vulnerability in web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a user to elevate privileges to that of an administrator...
Exploitation Observed: Ivanti Connect Secure — CVE-2023-46805 and CVE-2024-21887
...
Ivanti Connect Secure Unauthenticated Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ivanti Connect Secure Unauthenticated Remote Code Execution', 'Description' = %q This module chains a server side request forgery SSRF...
The vulnerability of Ivanti Connect Secure (previously known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons for Zero Trust Access (nZTA) – tools for authentication and access control – stems from incorrect restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information.
The vulnerability of Ivanti Connect Secure previously Pulse Connect Secure and Ivanti Policy Secure, as well as the authentication and access control management tools Ivanti Neurons for Zero Trust Access nZTA, is related to an incorrect restriction on XML links to external objects. Exploiting thi...
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
Xxe
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...
Ivanti Connect Secure and Ivanti Policy Secure Code Issue Vulnerabilities
Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a Network Access Control NAC solution. Ivanti Connect Secure and Ivanti Policy Secure have a code issue...
Ivanti Connect Secure 9.x / 22.x XML External Entity
Ivanti Connect Secure 9.x, 22.x suffers from an XML External Entity. By crafting a specific HTTP request, a remote attacker could exploit this vulnerability to access certain restricted resources without authentication. No source data...
