CVE-2025-26620

CVE-2025-26620 describes a race condition in Duende.AccessTokenManagement when multiple concurrent requests for client credentials tokens use varying TokenRequestParameters. The issue can cause concurrent requests to return tokens with incorrect protocol parameters (scope, resource indicator, etc...

IBM App Connect Enterprise Path Traversal Vulnerability

IBM App Connect Enterprise is an operating system from International Business Machines IBM, Inc. that combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud native IBM App Connect Enterprise combines existing industry-trusted IBM...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure network access control tools lies in improper external management of file names or paths, allowing attackers to write arbitrary files.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to improper external management of file names or file paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

SUSE CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

Ivanti Connect Secure < 22.7R2.6 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.6. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a...

Ivanti Connect Secure 22.x < 22.7R2.4 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.4. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a...

Ivanti Connect Secure 22.x < 22.7R2.3

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by a information disclosure vulnerability in the admin portal. A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local...

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools lies in the lack of measures taken to protect the website structure. This allows attackers to enhance their privileges and perform cross-site scripting attacks.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to enhance their privileges and perform cross-site scripting attacks...

The vulnerability of the Ivanti Connect Secure access control tool, related to reading data outside the buffer in memory, allows a intruder to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure access control tool lies in the reading of data outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-13830

Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2024-13843

Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

CVE-2024-13842

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

CVE-2025-22467

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-10644

Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

Ivanti Connect Secure and Ivanti Policy Secure external file control vulnerability

RISK EVALUATION Ivanti Connect Secure and Ivanti Policy Secure contain a vulnerability that allows a remote, authenticated attacker to write arbitrary files. These vulnerabilities are addressed in Ivanti Connect Secure version 22.7R2.6 and Ivanti Policy Secure version 22.7R1.3. 2. RECOMMENDED...

Vulnerabilities fixed in Ivanti Connect Secure and Ivanti Policy Secure

Ivanti has fixed vulnerabilities in Connect Secure and Policy Secure. The most pressing vulnerabilities include buffer overflow, command injection and code injection. These vulnerabilities allow remote authenticated attackers to remotely execute code, gain unauthorized access to sensitive...

Ivanti Patches Critical Flaws in Connect Secure and Policy Secure – Update Now

Ivanti has released security updates to address multiple security flaws impacting Connect Secure ICS, Policy Secure IPS, and Cloud Services Application CSA that could be exploited to achieve arbitrary code execution. The list of vulnerabilities is below - CVE-2024-38657 CVSS score: 9.1 - External...

CVE-2025-22467

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution...

CVE-2025-22467

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution...

CVE-2025-22467

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution...