PT-2024-3588 · Openvpn · Openvpn Connect

Name of the Vulnerable Software and Affected Versions: OpenVPN Connect versions 3.0 through 3.4.3 Windows OpenVPN Connect versions 3.0 through 3.4.7 macOS Description: The issue is related to the nodejs framework in OpenVPN Connect, which was not properly configured. This configuration issue allo...

CVE-2023-28900: Exposure of Sensitive Information to an Unauthorized Actor

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number...

CVE-2024-22317: Improper Restriction of Excessive Authentication Attempts

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a denial of service due to improper restriction of excessive authentication attempts. IBM X-Force ID: 279143...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote authenticated attacker due to the electron module (CVE-2023-45143)

Summary IBM App Connect Enterprise is vulnerable to allowing a remote authenticated attacker to obtain sensitive information, due to the electron module. Electron is used for Discovery Connectors in IBM App Connect Enterprise. This bulletin identifies the steps to take to address the vulnerabilit...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL. (CVE-2023-5363)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL in Node.js. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-5363 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information,...

Security Bulletin: IBM App Connect Enterprise Toolkit & IBM Integration Bus Toolkit are vulnerable to a remote attacker due to Apache Derby. (CVE-2022-46337)

Summary IBM App Connect Enterprise Toolkit & IBM Integration Bus Toolkit are vulnerable to a remote attacker due to Apache Derby, which affects the Derby Sample Database in the toolkit. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an information disclosure and a denial of service. (CVE-2024-22317)

Summary The remote administration API in IBM App Connect Enterprise is vulnerable to an information disclosure and denial of service vulnerability due to improper Brute Force protection. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

PT-2024-1300 · Unknown · Instawp Connect

Name of the Vulnerable Software and Affected Versions: InstaWP Connect versions 0.1.0.8 and earlier Description: The issue is related to improper privilege management, allowing privilege escalation. It is associated with the save management settings function and inadequate authorization procedure...

Ivanti Connect Secure Policy Secure Unauthorized Access

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure web components related to authentication procedures’ flaws. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted requests...

Exploit for Command Injection in Ivanti Connect_Secure

🚨 CVE-2024-21887 Exploit Tool 🛠️ A robust tool for detecting...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2023-46805 An authentication bypass vulnerability in the w...

EulerOS Virtualization 3.0.6.0 : python-pip (EulerOS-SA-2023-3450)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination server...

WordPress InstaWP Connect Plugin <= 0.1.0.8 is vulnerable to Privilege Escalation

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.8 Fixed in 0.1.0.9 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-22145 Patch priority High CVSS severity High 8.8 Developer InstaWP PSID f661e38694ec Credits Majed Refae...

VulnCheck KEV: CVE-2024-22145

Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through = 0.1.0.8...

VulnCheck KEV: CVE-2024-21893

Ivanti Connect Secure ICS, formerly known as Pulse Connect Secure, Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery SSRF vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication...

IBM DB2 Privilege Escalation

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect Server, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

OpenVPN Connect Code Execution

The vulnerability of the OpenVPN Connect software is related to the failure to implement measures to neutralize the instructions in the dynamically executed code. Exploiting this vulnerability can allow an attacker to execute arbitrary code using the DYILDINSERTLIBRARIES environment variable...

Ivanti Connect Secure Policy Secure Arbitrary Command Execution

The vulnerability of the Web interfaces of Ivanti Connect Secure and Ivanti Policy Secure lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2023-46805 Scanner CVE-2023-46805 Scanner for possible...

CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance...