Security Advisory Ivanti Sentry (CVE-2024-8540)

Security Advisory Ivanti Sentry CVE-2024-8540 Summary Ivanti has released updates for Ivanti Sentry which addresses one high severity vulnerability. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Descriptio...

December 2024 Security Advisory Ivanti Application Control (CVE-2024-11598)

Summary Ivanti has released updates for Ivanti Application Control which address one high severity vulnerability. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CVE Number| Description| CVSS Score Severity| CVSS Vector| CW...

December 2024 Security Advisory Ivanti Automation (CVE-2024-9845)

Summary Ivanti has released updates for Automation which addresses one high severity vulnerability. Successful exploitation could lead to local privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CVE Numbe...

December 2024 Security Advisory Ivanti Workspace Control (IWC) (CVE-2024-8496)

Summary Ivanti has released updates for Workspace Control which addresses one high severity vulnerability. Successful exploitation could lead to local privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability Details: CV...

PT-2024-36545

Name of the Vulnerable Software and Affected Versions ORing IAP-420 versions 2.01e and earlier Description The issue is caused by a lack of input validation in the web interface of ORing IAP-420, allowing Cross-Site Scripting XSS. Recommendations For versions 2.01e and earlier, update to a versio...

PT-2024-20701 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 11.0.0 through 11.0.1 Description: The issue concerns a malicious file upload vulnerability due to the lack of validation of the type of file uploaded to Journal entry attachments. Attackers can exploit this...

PT-2024-35763 · Seecms · Seecms

Name of the Vulnerable Software and Affected Versions: Seecms version 4.8 Description: A SQL injection issue was discovered in the SEMCMS SeoAndTag.php page. This issue allows for potential SQL injection attacks. Recommendations: For Seecms version 4.8, consider restricting access to the SEMCMS...

PT-2024-17271 · Unknown · Phpgurukul User Registration & Login/User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/index.php. The manipulation of the username argument leads to SQL injection. The...

OESA-2024-2383 rubygem-actionmailer security update

Email on Rails. Compose, deliver, and test emails using the familiar controller/view pattern. First-class support for multipart email and attachments. Security Fixes: Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5,...

Fedora 37 : libmodsecurity (2022-90453044f3)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-90453044f3 advisory. Update to maintenance release 3.0.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

PT-2024-31980 · Hathway · Hathway Skyworth Router Cm5100-511

Name of the Vulnerable Software and Affected Versions: Hathway Skyworth Router CM5100-511 version 4.1.1.24 Description: The issue concerns the storage of sensitive information about connected devices in plaintext. This affects devices connected via USB and Wifi. Recommendations: For version...

PT-2024-8069 · Microsoft · Windows Update Stack +1

Name of the Vulnerable Software and Affected Versions: Windows Update Stack versions prior to the fixed version Description: The issue is related to inadequate access control in the Windows Update Stack component of the Microsoft Windows operating system. This can be exploited to elevate...

CVE-2020-26309

CVE-2020-26309 concerns the Nope-validator (Validate.js) library. Versions 0.11.3 and earlier contain one or more regular expressions vulnerable to Regular Expression Denial of Service (ReDoS). Documented sources indicate this is a high-severity issue (CVSS-like: HIGH) with potential network expo...

CVE-2020-26309 GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, it is unknown if any patches are available...

CVE-2024-49359

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

PT-2024-35554

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc2-build3+ Description The issue is related to lock recursion in the Linux kernel, specifically in the afs wake up async call function. This function can incur lock recursion when called from AF RXRPC whi...

Security Advisory Ivanti Connect Secure and Policy Secure (CVE-2024-37404)

Summary Ivanti has released updates for Ivanti Connect Secure and Policy Secure which addresses a critical vulnerability. Successful exploitation could allow a remote authenticated attacker to achieve remote code execution. We are not aware of any customers being exploited by this vulnerability a...

Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2024-7612) 

Summary: Ivanti has released updates for Ivanti EPMM which addresses a high severity vulnerability. Successful exploitation could lead to an authenticated attacker accessing or modifying configuration files. We are not aware of any customers being exploited by these vulnerabilities at the time of...

PT-2024-7244 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: The issue is related to a buffer overflow vulnerability in the formSetWanPPPoE function of the /goform/formSetWanPPPoE file. This vulnerability can be exploited by sending a specially crafted...

PT-2024-12944 · Victure · Victure Pc420

Name of the Vulnerable Software and Affected Versions: Victure PC420 version 1.1.39 Description: The issue concerns a hardcoded root password stored in plaintext. Recommendations: For Victure PC420 version 1.1.39, consider changing the hardcoded root password to a unique and secure password as a...