PT-2025-32679 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 and 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4 Description: An XML...

Security Bulletin: Kafka client library upgraded to kafka-clients-3.9.1

Summary Kafka client library upgraded to kafka-clients-3.9.1. Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for...

Tigo Cloud Connect Advanced Session Identifier Issue

The vulnerability of the monitoring and control tool for solar energy systems, Tigo Cloud Connect Advanced CCA, is related to the improper generation of session identifiers. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

DEVICE_PING command in the Unauthorized Access

The vulnerability of the DEVICEPING command in the monitoring and management tool for solar energy systems, Tigo Cloud Connect Advanced CCA, is related to the lack of data cleaning at the control level during the processing of the final endpoint /cgi-bin/mobileapi. Exploiting this vulnerability c...

Tigo Cloud Connect Advanced Privilege Escalation

The vulnerability of the monitoring and control device for solar energy systems, Tigo Cloud Connect Advanced CCA, lies in the use of strictly encrypted account data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions, gain increased privileges, and obtain full...

Tigo Energy Cloud Connect Advanced (CCA) 4.0.1 - Command Injection

/ Title : Tigo Energy Cloud Connect Advanced CCA 4.0.1 - Command Injection Author : Byte Reaper CVE : CVE-2025-7769 / include include include include "argparse.h" include include include define FULLURL 2500 define POSTPAYLOAD 5500 const char baseurl = NULL; const char cookies = NULL; const char i...

CBL Mariner 2.0 Security Update: ceph (CVE-2024-48916)

The version of ceph installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-48916 advisory. - Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible t...

Linux Distros Unpatched Vulnerability : CVE-2023-23602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to...

Linux Distros Unpatched Vulnerability : CVE-2024-27053

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect...

Linux Distros Unpatched Vulnerability : CVE-2024-26741

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished. syzkaller...

CVE-2025-7768

Tigo Energy's Cloud Connect Advanced CCA device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar...

Linux Distros Unpatched Vulnerability : CVE-2022-50136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IWCMEVENTCONNECTREPLY event If siwrecvmparr returns -EAGAI...

Linux Distros Unpatched Vulnerability : CVE-2020-25672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak vulnerability was found in Linux kernel in llcpsockconnect CVE-2020-25672 Note that Nessus relies on the presence of the package as reported by th...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js (CVE-2025-23165 & CVE-2025-23166) )

Summary IBM App Connect Enterprise is vulnerable to Missing Release of Memory after Effective Lifetime and Uncaught Exception due to Node.js. Vulnerability Details CVEID:CVE-2025-23165 DESCRIPTION: In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file...

IBM DB2 DoS

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect Server, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted requests...

Linux Distros Unpatched Vulnerability : CVE-2021-3752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a rac...

Linux Distros Unpatched Vulnerability : CVE-2025-6427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections...

Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

...

IBM App Connect Enterprise (ACE) Path Traversal (7182418)

IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories. Note that Nessus has not tested fo...

CVE-2025-7768

Tigo Energy's Cloud Connect Advanced CCA device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerability enables attackers to escalate privileges and take full control of the device, potentially modifying system settings, disrupting solar...