org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2023-52428...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2023-52428...

com.erudika:para-server (1.22.0), org.id4me:aim-api-wrapper (>=1.0, <=2.0) +7 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.33)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.33 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.erudika:para-server 1.22.0 - org.id4me:aim-api-wrapper =1.0, =1.0, =1.3.0-rc1, =1.3.0-rc1, =1.3.0-rc...

com.microsoft.aad:adal4j (0.0.1), com.nimbusds:oauth2-oidc-sdk (>=2.14.2, <=3.0) +7 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.22.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.microsoft.aad:adal4j 0.0.1 - com.nimbusds:oauth2-oidc-sdk =2.14.2, =1.2, =1.2, =1.24.0, =1.1.1,...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2023-52428...

cn.kerrysmec.mpaas:unicorn (>=0.1.0, <=0.1.2), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.0-beta-1, <=2.0.0) +57 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (7.3)

com.nimbusds:nimbus-jose-jwt MAVEN version 7.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - cn.kerrysmec.mpaas:unicorn =0.1.0, =2.0.0-beta-1, =2.0.0-beta-1, =2.0.0-beta-1, =0.0.6, =0.0.6, =1.18.8,...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

Ivanti urges customers to patch yet another critical vulnerability

In a new blog post, Ivanti says that it has found another vulnerability and urges customers to “immediately take action to ensure you are fully protected”. This vulnerability only affects a limited number of supported versions–Ivanti Connect Secure version 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 a...

Exploit for Improper Restriction of XML External Entity Reference in Ivanti Connect_Secure

CVE-2024-22024 Check for CVE-2024-22024 vulnerability in Ivant...

Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways

Ivanti has alerted customers of yet another high-severity security flaw in its Connect Secure, Policy Secure, and ZTA gateway devices that could allow attackers to bypass authentication. The issue, tracked as CVE-2024-22024, is rated 8.3 out of 10 on the CVSS scoring system. "An XML external enti...

Vulnerability fixed in Ivanti Connect Secure and Policy Secure Gateways

Ivanti has fixed a vulnerability in Ivanti Connect Secure, Policy Secure and ZTA gateway. The vulnerability allows a malicious party to use an XML External Entity attack to gain access to system resources without having the required authentication. The vulnerability was discovered during the...

CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure

Executive Summary: As part of the ongoing investigation, we discovered a new vulnerability as part of our internal review and testing of our code, which was also responsibly disclosed by watchTowr. This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure...

Ivanti Connect Secure 9.x / 22.x Server-Side Request Forgery

Ivanti Connect Secure 9.x, 22.x suffers from a Server-Side Request Forgery. By crafting a specific HTTP request, a remote attacker could exploit this vulnerability to access certain restricted resources without authentication. No source data...

Ivanti Connect Secure 9.x / 22.x SSRF (CVE-2024-21893)

Binary data ivanticsCVE-2024-21893.nbin...

Ivanti Connect Secure 9.x / 22.x SSRF-RCE Chain (CVE-2024-21893)

Binary data ivanticsssrfrceCVE-2024-21893.nbin...

Ivanti Connect Secure Policy Secure Web Components

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure web components related to access control vulnerabilities. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the level of an administrator...

VulnCheck KEV: CVE-2024-22024

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x, Ivanti Policy Secure 9.x, 22.x and ZTA gateways which allows an attacker to access certain restricted resources without authentication...

Ivanti Connect Secure SAML Disclosure

The vulnerability of the SAML components in Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Ivanti Connect Secure Server-Side Request Forgery

Added: 02/05/2024 Background Ivanti Connect Secure is a web-based remote access VPN. Problem A server-side request forgery vulnerability in the SAML component allows attackers to access restricted resources without authentication. This can lead to remote command execution when chained with other...