CVE-2023-46265

An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery SSRF...

CVE-2023-46265

Ivanti Avalanche includes CVE-2023-46265 (XXE vulnerability in the Smart Device Server) that can allow an unauthenticated attacker to leak data or perform a Server-Side Request Forgery (SSRF). The issue is tied to a decode/XML processing path and is listed among multiple related CVEs in the 6.4.2...

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Ivanti Avalanche. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration o...

PT-2023-8279 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche affected versions not specified Description: The issue is related to an XML External Entity XXE vulnerability in the Smart Device Server, which could allow an unauthenticated attacker to leak data or perform a Server-Side...

CVE-2022-43554

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability...

CVE-2022-43554

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability...

Privilege escalation

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability...

CVE-2022-43554

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability...

CVE-2022-43554

Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability...

CVE-2022-43554

Ivanti Avalanche Smart Device Service contains an authentication bypass in its configuration (Apache Derby) that allows local users to escalate privileges. The flaw requires execution of low-privilege code and results in SYSTEM-level access. Affected component: Ivanti Avalanche Smart Device Servi...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche, which stems from a lack of authentication local lifting...

A week in security (September 4 - September 10)

Last week on Malwarebytes Labs: Supply chain related security risks, and how to protect against them Password-stealing Chrome extension smuggled on to Web Store Smart chastity device exposes sensitive user data X wants your biometric data Mac users targeted in new malvertising campaign delivering...

PT-2022-7216 · Ivanti · Ivanti Avalanche Smart Device Service

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche Smart Device Service affected versions not specified Description: The issue is related to a lack of authentication procedure for a critical function in the Smart Device Service of the Ivanti Avalanche system. Exploitation of...

Huawei EMUI and Magic UI out-of-bounds write vulnerability (CNVD-2023-01059)

Huawei EMUI is a mobile operating system based on Android development.Huawei Magic UI is a smart device operating system. Huawei EMUI and Magic UI have an out-of-bounds write vulnerability that can be exploited by an attacker to cause a crash and reboot...

Huawei EMUI and Huawei Magic UI Out-of-Bounds Write Vulnerability

Huawei EMUI is a mobile operating system based on Android development.Huawei Magic UI is a smart device operating system. Huawei EMUI and Magic UI have an out-of-bounds write vulnerability that can be exploited by an attacker to cause the system to reboot...

Huawei EMUI and Magic UI Information Disclosure Vulnerability (CNVD-2022-81251)

Huawei EMUI is a mobile operating system developed on Android. Huawei Magic UI is a smart device operating system. Huawei EMUI and Magic UI are vulnerable to an information disclosure vulnerability that originates from the issue of writing data to an arbitrary address in the HWKEYMASTER module,...

Weak password vulnerability in SRG3230 of Huawei Technologies Co.

Huawei Technologies Co. Ltd. is an ICT information and communications infrastructure and smart terminal provider. A weak password vulnerability exists in Huawei Technologies Co Ltd SRG3230, which can be exploited by attackers to obtain sensitive information...

D-Link Service. Cgi remote command execution vulnerability from discovery to intrusion detection-vulnerability warning-the black bar safety net

This D-link wireless router 615/645/815 router service. cgi remote command execution vulnerability, for example, gives a smart device to command injection class vulnerability static analysis to find bugs in the method. According to the vulnerability analysis carried out 615/645/815 router service...

West silent technology smart device/cgi-bin/checkCookie command execution vulnerability

No description provided by source...

Researchers Find Way to Extract 4096-Bit RSA Key via Sound

A trio of scientists have verified that results they first presented nearly 10 years ago are in fact valid, proving that they can extract a 4096-bit RSA key from a laptop using an acoustic side-channel attack that enables them to record the noise coming from the laptop during decryption, using a...