Ivanti Security Controls < 2024.4.1 Privilege Escalation

The version of Ivanti Security Controls running on the remote host is prior to 2024.4.1. It is, therefore, affected by a local privilege escalation vulnerability where under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 could allow a local...

CVE-2021-26115

An OS command injection CWE-78 vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection CWE-78 vulnerability in FortiWA...

CVE-2021-26093

An access of uninitialized pointer CWE-824 vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command...

Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to python - requests

Summary IBM Sterling Connect:Direct Web Service uses python - requests , python-requests could allow a remote attacker to obtain sensitive information, caused by the leaking of Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. Vulnerability Details...

CVE-2024-50570

A Cleartext Storage of Sensitive Information vulnerability CWE-312 in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN passwor...

CVE-2024-50570

A Cleartext Storage of Sensitive Information vulnerability CWE-312 in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN passwor...

PT-2024-34337

Name of the Vulnerable Software and Affected Versions: FortiClientWindows versions 7.0.0 through 7.0.13 FortiClientWindows versions 7.2.0 through 7.2.6 FortiClientWindows versions 7.4.0 through 7.4.1 FortiClientLinux versions 7.0.0 through 7.0.13 FortiClientLinux versions 7.2.0 through 7.2.7...

CVE-2024-9845

CVE-2024-9845 affects Ivanti Automation prior to 2024.4.0.1. The issue is due to insecure permissions, enabling a local authenticated attacker to achieve local privilege escalation. The CVSS is 3.1/3.0-based vectors with a base score of 7.8 (HIGH) and local access requirements. Remediation: upgra...

CVE-2024-12363

The CVE-2024-12363 issue affects TeamViewer Patch & Asset Management (part of TeamViewer Remote Management) in Windows prior to version 24.12. The vulnerability stems from insufficient permissions, allowing a local authenticated user to delete arbitrary files. Reported CVSSv3.1 base score is 7.1 ...

CVE-2024-10251: Incorrect Default Permissions

Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-8496: Incorrect Default Permissions

Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845: Incorrect Default Permissions

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

PT-2024-9461 · Teamviewer · Teamviewer Patch & Asset Management

Name of the Vulnerable Software and Affected Versions: TeamViewer Patch & Asset Management versions prior to 24.12 Description: The issue is related to insufficient permissions in the TeamViewer Patch & Asset Management component, which allows a local authenticated user to delete arbitrary files...

CVE-2024-12363: Incorrect Permission Assignment for Critical Resource

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management...

CVE-2024-11597: Incorrect Default Permissions

Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-7572

Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-10256

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-7572

Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-7572

CVE-2024-7572 affects Ivanti Desktop and Server Management (DSM). The issue arises from insufficient permissions in DSM prior to 2024.3.5740, allowing a local authenticated attacker (low privileges) to delete arbitrary files, with impact rated high (I and A) and local attack vector. A fixed versi...

CVE-2024-7572

Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files...