IBM MaaS360 Trust Management Issue Vulnerability

IBM MaaS360 is a suite of enterprise mobile device management solutions from International Business Machines IBM. The solution provides end-to-end security and management of mobile devices, documents, applications and email. A trust management issue vulnerability exists in IBM MaaS360 versions 6....

Cambium EPMP 1000 Get_chart Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP 1000 'getchart' Command Injection v3.1-3.5-RC7", 'Description' = % This module exploits an OS Command Injection vulnerability in...

Meteocontrol WEBlog Password Extractor

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Meteocontrol WEBlog Password Extractor', 'Description' = % This module exploits an authentication bypass vulnerability in Meteocontrol WEBLog...

Cambium EPMP 1000 Account Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cambium ePMP 1000 Account Password Reset', 'Description' = % This module exploits an access control vulnerability in Cambium ePMP device manageme...

PT-2024-26153 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the code of OwnersData.java, specifically in the shouldWrite method. This error can prevent MDM policies from...

PT-2025-16921 · Google · Chrome Os

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 124.0.6367.34 Description: The issue allows enrolled users with local access to unenroll devices and intercept device management requests by loading components from the unencrypted stateful partition. This is due to a...

PT-2024-8681

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions 6.3.1 Description A NULL pointer dereference exists in the WLAvalancheService component of Ivanti Avalanche. This issue allows a remote, unauthenticated attacker to cause a denial-of-service DoS condition by crashing...

The vulnerability of the web component of the mobile device and mobile application lifecycle management application, Ivanti Endpoint Manager Mobile (EPMM) (formerly MobileIron Core), allows a perpetrator to gain access to confidential data.

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM web component for managing the lifecycle of mobile devices and applications formerly known as MobileIron Core is related to authentication process flaws. Exploiting this vulnerability could allow a malicious actor to gain access to...

The vulnerability of the input/output device management component of the IOHIDFamily in operating systems such as iPadOS and iOS, as well as macOS, allows attackers to disclose protected information.

The vulnerability of the input/output device management component of the IOHIDFamily in iPadOS, iOS, and macOS is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to disclose protected information...

Citrix Endpoint Management: Guide for Enrolment issues

Introduction Enrollment issues in the Citrix XenMobile environment can significantly disrupt device management and user access. From iOS to Android platforms, these challenges range from failed MDM profile installations and persistent policy configurations to login failures and administrative rol...

How to retrieve the keystore password needed to renew the HTTPS internal XenMobile SSL certificate

The internal SSL certificate has expired and Mobile Device Management MDM administrator does not remember the keystore password to renew the HTTPS certificate https.p12...

CVE-2024-39871

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage...

PT-2024-7956 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP1 Description: The issue is related to improper authorization. It allows a remote attacker to gain unauthorized access to participant groups they should not have access to. The vulnerabili...

CVE-2024-39479

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon and hwmon drvdata on which hwmon depends are device managed resources, the expectation, on device unbind, is that hwmon will be released before drvdata. However, in i915 there are t...

Weak password vulnerability in cryptographic device management platform of Sanwei Xin'an Technology Co. Ltd (CNVD-2024-35767)

Ltd. is a cryptographic infrastructure provider, focusing on innovative breakthroughs in key cryptographic technologies and the research, development, sales and service of core products, providing comprehensive commercial cryptographic products and solutions for the field of network information...

Big name TikTok accounts hijacked after opening DM

High profile TikTok accounts, including CNN, Sony, and—er­—Paris Hilton have been targeted in a recent attack. CNN was the first account takeover that made the news, with Semafor reporting that the account was down for several days after the incident. According to Forbes, the attack happens witho...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.x. The vulnerability stems from the...

A week in security (May 20 – May 26)

Last week on Malwarebytes Labs: How AI will change your credit card behind the scenes Criminal record database of millions of Americans dumped online Microsoft AI "Recall" feature records everything, secures far less How to remove a user from a shared Android device How to remove a user from a...

D-Link D-View Code Execution Vulnerability

D-Link D-View is a Web-based design network device management software from China AUO D-Link. A code execution vulnerability exists in D-Link D-View that stems from the application failing to properly filter special elements that construct code segments. An attacker could exploit the vulnerabilit...

D-Link D-View Trust Management Issue Vulnerability

D-Link D-View is a Web-based design network device management software from China AUO D-Link. A trust management issue vulnerability exists in D-Link D-View8, which stems from the use of hard-coded encryption keys, and can be exploited by an attacker to bypass authentication on the system...