Ivanti Releases Patch for Vulnerabilities Impacting Connect Secure and Policy Secure (CVE-2024-21888 & CVE-2024-21893)

Ivanti Connect Secure and Policy Secure are vulnerable to high-severity flaws (CVE-2024-21888 & CVE-2024-21893) that may lead to privilege escalation and arbitrary code execution on vulnerable systems. One of the flaws tracked as CVE-2024-21893 is being exploited in the wild. Ivanti mentioned in the advisory that they are aware of a few customers who have … Continue reading “Ivanti Releases Patch for Vulnerabilities Impacting Connect Secure and Policy Secure (CVE-2024-21888 & CVE-2024-21893)”

Ivanti Avalanche Directory Traversal Vulnerability (CVE-2023-41474)

Ivanti Avalanche, a popular mobile device management system, is vulnerable to a limited unauthenticated path traversal vulnerability, tracked as CVE-2023-41474. The vulnerability may allow an unauthenticated attacker to access any file under C:\\PROGRAM DATA\\Wavelink\\AVALANCHE\\Web\ webapps\AvalancheWeb in a default configuration. However, an attacker can only read some specific file extensions like .xml or .html, depending on the … Continue reading “Ivanti Avalanche Directory Traversal Vulnerability (CVE-2023-41474)”

Jenkins Core Remote Code Execution Vulnerability (CVE-2024-23897)

Jenkins has addressed a critical severity vulnerability (CVE-2024-23897) affecting Jenkins Core. Successful exploitation of the vulnerability may allow an attacker to perform remote code execution on target systems. The vulnerability is being exploited in the wild. Many threat researchers have released the PoC for the vulnerability.

VMware Aria Automation Missing Access Control Vulnerability (CVE-2023-34063)

The Commonwealth Scientific and Industrial Research Organization’s (CSIRO) Scientific Computing Platforms team discovered an access control vulnerability impacting VMware Aria Automation. CVE-2023-34063 has a critical severity rating with a CVSS score of 9.9. The vulnerability may allow an authenticated malicious actor to get unauthorized access to remote organizations and workflows. An authenticated attacker may exploit … Continue reading “VMware Aria Automation Missing Access Control Vulnerability (CVE-2023-34063)”

Apache Superset Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2023-49657)

Apache Superset, an open-source data visualization software, is vulnerable to a flaw that could allow an attacker to perform stored cross-site scripting attacks. Tracked as CVE-2023-49657, the vulnerability has a critical severity with a CVSS score of 9.6. An attacker must be authenticated and have create/update permissions on charts or dashboards to exploit the vulnerability. An … Continue reading “Apache Superset Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2023-49657)”

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2024-0252)

Zoho addressed a vulnerability in the ManageEngine ADSelfService Plus, CVE-2024-0252. The vulnerability is given a critical severity and a CVSS score of 9.9. The vulnerability may allow an authenticated attacker to perform remote code execution on the system with ADSelfService Plus installed. The vulnerability exists in the load balancer component of ADSelfService Plus. Zoho stated … Continue reading “Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2024-0252)”

Apple Releases Patch for Zero-day Vulnerabilities Used in Attack Against iOS and macOS (CVE-2024-23222, CVE-2023-42916, & CVE-2023-42917)

Threat actors are using CVE-2024-23222, CVE-2023-42916, and CVE-2023-42917 vulnerabilities in attacks against iOS and Macs. Apple has addressed the vulnerabilities in products such as Safari, iOS, iPadOS, macOS, watchOS, and tvOS. Along with the zero-day vulnerability, Apple has addressed multiple vulnerabilities affecting its popular products. CISA has added the CVE-2024-23222 to its Known Exploited Vulnerabilities Catalog, … Continue reading “Apple Releases Patch for Zero-day Vulnerabilities Used in Attack Against iOS and macOS (CVE-2024-23222, CVE-2023-42916, & CVE-2023-42917)”

Evernote Remote Code Execution Vulnerability (CVE-2023-50643)

Evernote is vulnerable to a flaw that can lead to remote code execution on successful exploitation. Tracked as CVE-2023-50643, the vulnerability has a critical severity rating and a CVSS score of 9.8. On successful exploitation, a remote attacker may execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components.

GoAnywhere Managed File Transfer (MFT) Authentication Bypass Vulnerability (CVE-2024-0204)

Security researchers at Spark Engineering Consultants have discovered an authentication bypass vulnerability in GoAnywhere Managed File Transfer. Tracked as CVE-2024-0204, the vulnerability has a critical severity and a CVSS score of 9.8. The vulnerability allows an unauthorized user to create an admin user via the administration portal.