InfoSecBulletin Cybersecurity for mankind
CISA included three vulnerabilities in Ivanti Endpoint Manager—CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161—in its Known Exploited Vulnerabilities catalog.
Federal agencies must address these vulnerabilities by March 31, 2025, according to CISA’s directive, although no direct ransomware connection has been established.
AMD discloses 4 new CPU flaws Affecting Many CPUs
GitLab patched XSS and Authorization Bypass Flaws
CVE-2025-7206
Critical D-Link DIR-825 Router Flaw Remote Crash Via Buffer Overflow
Urgently patch now: Zoom Patches 6 Flaws
Whatsapp rival ‘Bitchat’, message without internet
Splunk Addresses Third-Party Package Vulns in SOAR Versions
Texas-based Tax Credit Consultancy agency exposed PII, ID Numbers, & SSNs
CVE-2025-25257
Fortinet Addresses Major SQL Injection Flaw in FortiWeb
Microsoft July 2025 Patch Tuesday: One zero-day, 137 flaws
Android malware Anatsa infiltrates Google Play targeting banks worldwide
CISA updated its KEV catalog on March 10, 2025, adding three new vulnerabilities found in Ivanti Endpoint Manager, a popular enterprise software for managing endpoints.
The KEV catalog tracks actively exploited vulnerabilities, encouraging organizations to prioritize fixes to protect critical systems.
The vulnerabilities CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161 are all path traversal issues
Each flaw allows an attacker to access sensitive files by changing file paths, which could expose important information like configuration data or credentials.
Action Required:
Organizations must follow Ivanti’s guidelines, comply with BOD 22-01 for cloud services, or stop using the service if patches are not available.
Deadline: Federal agencies must fix these vulnerabilities by March 31, 2025.
Date Added: They were all added to the KEV catalog on March 10, 2025, due to new evidence of exploitation.
Recommendations:
Monitor Ivanti’s support portal for updates. Limit unauthorized access to EPM instances using firewalls or VPNs. Review file access logs for path traversal attempts. The inclusion of CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161 in CISA’s KEV catalog highlights the increasing risks to endpoint management systems.
Federal agencies have a three-week window to address issues. Enterprises using Ivanti EPM should quickly reduce risks and prevent data leaks from becoming major breaches.
