Pulse Connect Secure < 22.7R2.3 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker ...

Ivanti Connect Secure Buffer Overflow Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from a buffer overflow vulnerability that...

Ivanti Connect Secure Out-of-Bounds Read Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from an out-of-bounds read vulnerability...

The vulnerability of Siemens SINEMA Remote Connect allows a hacker to gain unauthorized access to groups of participants to which they do not have permission to access.

The vulnerability of the Siemens SINEMA Remote Connect server is related to incorrect authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to groups of participants to which they do not have access...

The vulnerability of the authentication module through the OpenID Connect protocol in NGINX web servers, related to improper session management, allows attackers to gain full access to the application.

The vulnerability of the authentication module through the OpenID Connect protocol in NGINX web servers is related to improper session management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the application by intercepting sessions...

The vulnerability of Siemens SINEMA Remote Connect lies in the insufficient checking of unusual or exceptional states, allowing a perpetrator to trigger a service failure.

The vulnerability of the Siemens SINEMA Remote Connect web interface is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the Jenkins OpenId Connect plugin, related to authentication process flaws, allows attackers to bypass the authentication process.

The vulnerability of the Jenkins OpenId Connect plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614ebe0a invalidates...

GHSA-H23J-73WW-7594 Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. OpenId Connect Authentication Plugin 4.421.v5422614ebe0a invalidates...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

CVE-2024-52553

CVE-2024-52553 affects Jenkins OpenId Connect Authentication Plugin, with vulnerable versions 4.418.vccc7061f5b_6d and earlier. The root cause is that the plugin does not invalidate the previous session on login, creating a possible session fixation risk. This could enable an attacker to gain adm...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

Ivanti Connect Secure and Ivanti Policy Secure Multiple Vulnerabilities

RISK EVALUATION Ivanti Connect Secure and Ivanti Policy Secure contain multiple vulnerabilities that allow a remote, authenticated attacker to execute arbitrary code. All of the vulnerabilities except for CVE-2024-39709 require the attacker to be authenticated with administrative privileges to...

Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

Ivanti has fixed vulnerabilities in Connect Secure and Policy Secure. A malicious party could exploit the vulnerabilities to launch attacks that could result in the following categories of damage: Denial-of-Service DoS Cross-Site Scripting XSS. Increased user privileges Remote code execution User...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...