CVE-2024-50317

CVE-2024-50317 affects Ivanti Avalanche before 6.4.6. The issue is a null pointer dereference in the WLAvalancheService (listening on TCP port 1777) that allows a remote unauthenticated attacker to cause a denial of service. Impact is DoS without authentication; vulnerability is fixed in version ...

CVE-2024-50317

A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service...

PT-2024-32883 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: A stack-based buffer overflow in IPsec allows a remote unauthenticated attacker to cause a denial of service. Recommendations: For versions prior to 22.7R2.3, update to version...

CVE-2024-22733

TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...

CVE-2024-47575

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4,...

Archer Platform 安全漏洞

Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in Archer Platform versions prior to 2024.09, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that could allow a remote, unauthenticated attacker ...

Ivanti Avalanche < 6.4.5 Multiple Vulnerabilities

The version of Ivanti Avalanche running on the remote host is prior to 6.4.5. It is, therefore, is affected by multiple vulnerabilities : - A NULL pointer dereference in WLAvalancheService allows a remote unauthenticated attacker to crash the service. CVE-2024-47007 - Server-side request forgery...

Esri Portal for ArcGIS < Security 2024 Update 2 Multiple Vulnerabilities

The version of Esri Portal for ArcGIS installed is missing Security 2024 Update 2. It is, therefore, affected by multiple vulnerabilities including: - There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. 11.1, 11.0 and 10.9.1 that may allow a remote, unauthenticated...

CVE-2024-47011

Ivanti Avalanche is affected by a path traversal vulnerability (CVE-2024-47011) that allows a remote unauthenticated attacker to leak sensitive information in versions prior to 6.4.5. Public disclosures and Red Hat/NVD entries corroborate the issue and indicate that fixes were introduced in later...

CVE-2024-47010

CVE-2024-47010 affects Ivanti Avalanche prior to version 6.4.5, with a path traversal that enables a remote unauthenticated attacker to bypass authentication. The issue is addressed by Ivanti in 6.4.5 (and related advisories), and references indicate follow‑ups for related CVEs (e.g., 6.4.7) addr...

CVE-2024-47009

Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication...

CVE-2024-47009

Ivanti Avalanche before 6.4.5 is affected by a Path Traversal vulnerability (CVE-2024-47009) that allows a remote, unauthenticated attacker to bypass authentication. The issue is documented across multiple sources (e.g., Red Hat advisory, NVD/NASL plugin context, NCCS/Nessus notes) and is address...

CVE-2024-47008

Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information...

CVE-2024-47008

Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information...

CVE-2024-47007

A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-47295

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under...

Synology DiskStation Manager Netatalk Out-of-bounds Write (CVE-2018-1160)

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsiopensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution. This plugin only works with Tenable.ot. Pleas...

PT-2024-32506 · Seiko Epson · Seiko Epson Web Config

Name of the Vulnerable Software and Affected Versions: SEIKO EPSON Web Config affected versions not specified Description: The issue is related to an insecure initial password configuration in SEIKO EPSON Web Config, allowing a remote unauthenticated attacker to set an arbitrary password and...

CISA Flags Critical Ivanti vTM Vulnerability Amid Active Exploitation Concerns

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added a critical security flaw impacting Ivanti Virtual Traffic Manager vTM to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2024-7593 CVSS...

CVE-2024-8963

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...