Ivanti Connect Secure < 22.7R2.6 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.6. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a...

Ivanti Connect Secure 22.x < 22.7R2.4 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.4. It is, therefore, affected by multiple vulnerabilities in the admin portal: - External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a...

Ivanti Connect Secure 22.x < 22.7R2.3

The Ivanti Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by a information disclosure vulnerability in the admin portal. A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local...

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools lies in the lack of measures taken to protect the website structure. This allows attackers to enhance their privileges and perform cross-site scripting attacks.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to enhance their privileges and perform cross-site scripting attacks...

The vulnerability of the Ivanti Connect Secure access control tool, related to reading data outside the buffer in memory, allows a intruder to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure access control tool lies in the reading of data outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-24888

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...

CVE-2024-13830

Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2024-13843

Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

CVE-2024-13842

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...

CVE-2025-22467

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-10644

Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-13813

Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files...

Fast Deployments, Secure Code: Watch this Learn to Sync Dev and Sec Teams

Ever felt like your team is stuck in a constant battle? Developers rush to add new features, while security folks worry about vulnerabilities. What if you could bring both sides together without sacrificing one for the other? We invite you to our upcoming webinar, "Opening the Fast Lane for Secur...

mySCADA myPRO Manager

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary OS commands, upload files, and obtain sensitive information without providing associated credentials. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize...

PT-2025-6873

Name of the Vulnerable Software and Affected Versions Fedora Linux kernel versions 6.12 through 6.12.13 Description A critical flaw in the Fedora Linux kernel disables Lockdown Mode by default, potentially allowing attackers to bypass Secure Boot protections. This issue affects systems starting a...

Weak TLS Ciphers on Brocade SANnav OVA SSH port 22. (CVE-2024-4282)

Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. Detail The SSH protocol Secure Shell is a method for secure remote login from one computer to another. The target is using deprecated SHA1 cryptographic settings to communicate. IMPACT: vulnerable to...

DEBIAN-CVE-2024-36293

Improper access control in the EDECCSSA user leaf function for some IntelR Processors with IntelR SGX may allow an authenticated user to potentially enable denial of service via local access...

Ivanti Connect Secure and Ivanti Policy Secure external file control vulnerability

RISK EVALUATION Ivanti Connect Secure and Ivanti Policy Secure contain a vulnerability that allows a remote, authenticated attacker to write arbitrary files. These vulnerabilities are addressed in Ivanti Connect Secure version 22.7R2.6 and Ivanti Policy Secure version 22.7R1.3. 2. RECOMMENDED...

PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface

An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but doe...

CVE-2025-1042

An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way...