Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
183 results · page 2 of 4
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-37376 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to aCVE-2024-34787 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.8
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-34784 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-34782 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-34781 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-34780 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-32847 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-32844 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-32841 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with aCVE-2024-32839 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.CVE-2024-7612 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.8
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
- Product
- Endpoint Manager Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024There exists a use after free vulnerability in Reverb.CVE-2024-8375 · Computers, phones & browsers · Google Deepmind · reported by cve-coordination@google.comMedium 5.7
There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance. Afterwards, Reverb copies the content in tensor_content to the previously mentioned pre-allocated memory, which results in the bytes in tensor_content overwriting the vtable pointers of all the objects which were previously allocated. Reverb exposes 2 relevant gRPC endpoints: InsertStream and SampleStream. The attacker can insert this stream into the server’s database, then when the client next calls SampleStream they will unpack the tensor into RAM, and when any method on that object is called (including its destructor) the attacker gains control of the Program Counter. We recommend upgrading past git commit https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25
- Product
- Reverb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentCVE-2024-37397 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.2
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34785 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34783 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-34779 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32848 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32846 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32845 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32843 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32842 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieveCVE-2024-32840 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.2
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to acCVE-2024-29847 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privilegesCVE-2024-8441 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 6.7
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted CVE-2024-8322 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 4.3
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate manaCVE-2024-8321 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5.8
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof NetworCVE-2024-8320 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 5.3
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote cCVE-2024-8191 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.8
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.CVE-2024-36132 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.5
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on thCVE-2024-36131 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary cCVE-2024-36130 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.8
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive informationCVE-2024-34788 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.5
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary CVE-2024-37381 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute aCVE-2024-29846 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute aCVE-2024-29830 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute aCVE-2024-29829 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute aCVE-2024-29828 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to executeCVE-2024-29827 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to executeCVE-2024-29826 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to executeCVE-2024-29825 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024Ivanti Endpoint Manager (EPM) SQL Injection VulnerabilityCVE-2024-29824 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 8.8
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- Endpoint Manager (EPM)
- On CISA’s list since
- Oct 2, 2024 (federal fix deadline Oct 23, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to executeCVE-2024-29823 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to executeCVE-2024-29822 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 8.8
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 31, 2024A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in IvantCVE-2024-22058 · Network & remote access · Ivanti · reported by support@hackerone.comHigh 7.8
A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older.
- Product
- EPM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 22, 2024A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commandsCVE-2024-22026 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.7
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 22, 2024An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the CVE-2023-46807 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.7
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 22, 2024An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify dCVE-2023-46806 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.7
An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Apr 30, 2024DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938.CVE-2024-31837 · Other software · reported by MITREHigh 8.4
DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023 Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gaiCVE-2023-6691 · Other software · Cambium · reported by ics-cert@hq.dhs.govHigh 7.8
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.
- Product
- ePMP Force 300-25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow.CVE-2023-21217 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In PMRWritePMPageList of TBD, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.