29420 matches found
Vulnerabilities fixed in Ivanti Cloud Services Appliance
Ivanti has fixed vulnerabilities in Cloud Services Appliance v 4.6. A malicious party could exploit the vulnerabilities to execute a command-injection via path-traversal, allowing the system to be operated and possibly taken over without prior authentication. Ivanti says it has information that t...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by IBM WebSphere Application Server Liberty cross-site scripting (CVE-2024-27270)
Summary IBM WebSphere Application Server Liberty is vulnerable to cross-site scripting CVE-2024-27270 may affect SPSS Collaboration and Deployment Services Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Product...
CVE-2024-45806
A vulnerability was found in Envoy that allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918...
Chrome Users Can Now Sync Passkeys Across Devices with New Google PIN Feature
Google on Thursday unveiled a Password Manager PIN to let Chrome web users sync their passkeys across Windows, macOS, Linux, ChromeOS, and Android devices. "This PIN adds an additional layer of security to ensure your passkeys are end-to-end encrypted and can't be accessed by anyone, not even...
CVE-2024-45806
CVE-2024-45806 affects Envoy, a cloud-native edge proxy. The vulnerability stems from Envoy’s default handling of internal RFC1918 addresses, which are trusted even if internal_address_config is empty. An external client could exploit this to manipulate headers (e.g., x-envoy headers), potentiall...
CVE-2024-7207
Rejected reason: Duplicate of CVE-2024-45806...
Ivanti Releases Admin Bypass Security Update for Cloud Services Appliance
Ivanti has released a security update to address an admin bypass vulnerability CVE-2024-8963link is external affecting Ivanti Cloud Services Appliance CSA version 4.6. A cyber threat actor could exploit this vulnerability in conjunction with CVE-2024-8190link is external–detailed in a Sept. 13...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-8963link is external Ivanti Cloud Services Appliance CSA Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-8963 Ivanti Cloud Services Appliance CSA Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and...
PT-2024-6628
The vulnerable software is Ivanti's Cloud Services Appliance CSA, specifically versions before 4.6 Patch 519. This path traversal issue allows a remote unauthenticated attacker to access restricted functionality. The flaw is being actively exploited, and it is recommended to patch to version 4.6...
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Ivanti Cloud Services Appliance CSA contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary...
Ivanti Cloud Services Appliance 安全漏洞
The Ivanti Cloud Services Appliance Ivanti CSA is an Internet application from Ivanti Corporation, USA. It provides secure communications and functionality over the Internet. A security vulnerability exists in the Ivanti Cloud Services Appliance prior to version 4.6 Patch 519, which stems from th...
nss: vulnerable to Minerva side-channel information leak
The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...
nss: vulnerable to Minerva side-channel information leak
The Network Security Services NSS package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key...
USN-7021-1: Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - BTRFS file system; - F2FS file system; - GFS2 file system; - BPF subsystem; - Netfilter; - RxRPC...
The vulnerability of the Windows Storage Services data storage service on Windows operating systems allows attackers to exploit their privileges.
The vulnerability of the Windows Storage Services data storage service in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the Ivanti Cloud Services Appliance’s networking component exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary code.
The vulnerability of the Ivanti Cloud Services Appliance exists because measures to neutralize special elements used in the operating system are not taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
VulnCheck KEV: CVE-2023-3368
Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account...