JetBrains has released a patch to address a critical flaw tracked as CVE-2024-23917. The vulnerability in TeamCity On-Premises may allow an attacker to gain admin privileges on successful exploitation.
Tag: authentication bypass vulnerability
GoAnywhere Managed File Transfer (MFT) Authentication Bypass Vulnerability (CVE-2024-0204)
Security researchers at Spark Engineering Consultants have discovered an authentication bypass vulnerability in GoAnywhere Managed File Transfer. Tracked as CVE-2024-0204, the vulnerability has a critical severity and a CVSS score of 9.8. The vulnerability allows an unauthorized user to create an admin user via the administration portal.
Ivanti Connect Secure (ICS) and Ivanti Policy Secure Gateway Vulnerabilities Exploited in the Wild (CVE-2023-46805 & CVE-2024-21887)
The security research team at Veloxity identified an active exploitation of two vulnerabilities (CVE-2023-46805 & CVE-2024-21887) impacting Ivanti Connect Secure VPN devices. When chained together, the vulnerabilities may allow attackers to transmit malicious requests and execute arbitrary commands on a targeted system. According to the research, a Chinese nation-state-level threat actor has exploited the vulnerabilities. … Continue reading “Ivanti Connect Secure (ICS) and Ivanti Policy Secure Gateway Vulnerabilities Exploited in the Wild (CVE-2023-46805 & CVE-2024-21887)”
Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-51467)
The SonicWall Threat research team has discovered an authentication bypass vulnerability in Apache OFBiz, a Java-based web framework. Tracked as CVE-2023-51467, the vulnerability has a critical severity rating with a CVSS score of 9.8. An attacker who exploits the vulnerability may bypass authentication to achieve a simple Server-Side Request Forgery (SSRF). A security researcher at … Continue reading “Apache OFBiz Authentication Bypass Vulnerability (CVE-2023-51467)”
VMware Cloud Director Authentication Bypass Vulnerability (CVE-2023-34060)
Dustin Hartle from Ideal Integrations Inc. has discovered an authentication bypass vulnerability in VMware Cloud Director Appliance (VCD Appliance). CVE-2023-34060 is given critical severity with a CVSS score of 9.8. Successful exploitation of the vulnerability may allow an attacker to bypass login restrictions when authenticating.
Ivanti Sentry Zero-day Vulnerability being Exploited in the wild (CVE-2023-38035)
Ivanti has released a patch to an actively exploited API Authentication Bypass vulnerability. CVE-2023-38035 has been given a high severity rating with a CVSS score of 9.8. The vulnerability may allow an unauthenticated actor to access sensitive APIs configuring the Ivanti Sentry on the administrator portal. Ivanti has mentioned in the advisory that they are … Continue reading “Ivanti Sentry Zero-day Vulnerability being Exploited in the wild (CVE-2023-38035)”
Grafana Critical Authentication Bypass Vulnerability (CVE-2023-3128)
Grafana has released security updates to address an authentication bypass/account takeover vulnerability. CVE-2023-3128 has been rated as critical with a CVSSv3.1 base score of 9.4. Successful exploitation of the vulnerability will allow an attacker to gain complete control of a user’s account, including access to private customer data and sensitive information. Grafana is a multi-platform … Continue reading “Grafana Critical Authentication Bypass Vulnerability (CVE-2023-3128)”
VMware Tools Zero-day Authentication Bypass Vulnerability Exploited by Chinese Hackers (CVE-2023-20867)
VMware addressed an authentication bypass vulnerability in VMware Tools. CVE-2023-20867 may allow attackers to execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication. The vulnerability was discovered by Mandiant. The firm suggests that the cyber espionage group known as UNC3886 has exploited the vulnerability. VMware Tools is a set of services … Continue reading “VMware Tools Zero-day Authentication Bypass Vulnerability Exploited by Chinese Hackers (CVE-2023-20867)”
PaperCut NG Remote Code Execution Vulnerability Exploited in the Wild (CVE-2023-27350)
PaperCut, a print manager software, has a remote code execution vulnerability that is being actively exploited. CVE-2023-27350 has been rated as critical with a CVSS Base Score of 9.8. Successful exploitation of the vulnerability allows unauthenticated attackers to perform remote code execution to compromise the vulnerable PaperCut application server. The vendor mentioned in the advisory … Continue reading “PaperCut NG Remote Code Execution Vulnerability Exploited in the Wild (CVE-2023-27350)”
Cisco EoL Small Business VPN Routers Multiple Vulnerabilities (CVE-2023-20025 & CVE-2023-20026)
Cisco released a security advisory to address critical severity vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers (CVE-2023-20025 & CVE-2023-20026). On successful exploitation, these vulnerabilities could allow a remote attacker to bypass authentication or execute arbitrary commands on affected devices. Hou Liuyang of Qihoo 360 Netlab … Continue reading “Cisco EoL Small Business VPN Routers Multiple Vulnerabilities (CVE-2023-20025 & CVE-2023-20026)”
