CISA has issued an urgent alert about critical vulnerabilities being exploited in Synacor’s Zimbra Collaboration and Ivanti’s Endpoint Manager (EPM). Organizations using these products are urged to mitigate potential risks immediately.
CVE-2024-45519: Synacor Zimbra Collaboration Command Execution Vulnerability:
By infosecbulletin
/ Friday , October 4 2024
CISA has issued an urgent alert about critical vulnerabilities being exploited in Synacor’s Zimbra Collaboration and Ivanti’s Endpoint Manager (EPM)....
Read More
By infosecbulletin
/ Friday , October 4 2024
ISACA 2024 survey report reveals that 66% of cybersecurity professionals find their jobs more stressful now than five years ago....
Read More
By infosecbulletin
/ Friday , October 4 2024
A recent study by ISACA shows that almost two-thirds of cybersecurity professionals report increasing job stress. The 2024 State of...
Read More
By infosecbulletin
/ Friday , October 4 2024
In September, cybersecurity experts discovered 31 new ransomware variants that threaten individuals and businesses. These programs encrypt valuable data, making...
Read More
By infosecbulletin
/ Thursday , October 3 2024
New guidance on ransomware, released during this week's International Counter Ransomware Initiative (CRI) meeting, encourages victims to report attacks to...
Read More
By infosecbulletin
/ Thursday , October 3 2024
Over 14 new security flaws have been found in DrayTek routers for homes and businesses, which could allow attackers to...
Read More
By infosecbulletin
/ Wednesday , October 2 2024
Hackers are exploiting a recently revealed RCE vulnerability in Zimbra email servers that can be activated by sending specially crafted...
Read More
By infosecbulletin
/ Wednesday , October 2 2024
CISA warns of two serious vulnerabilities in Optigo Networks ONS-S8 Aggregation Switches, which could allow authentication bypass and remote code...
Read More
By infosecbulletin
/ Wednesday , October 2 2024
On October 1, 2024, CISA released two advisories regarding Industrial Control Systems (ICS), highlighting current security issues, vulnerabilities, and exploits...
Read More
By infosecbulletin
/ Tuesday , October 1 2024
DataDog security researchers found that hackers are widely exploiting Docker Swarm, Kubernetes, and SSH servers. The newly discovered malware campaign...
Read More
A new vulnerability, CVE-2024-45519, has been found in the Synacor Zimbra Collaboration platform. It affects the postjournal service and could let unauthenticated users run commands remotely.
It’s unclear if this vulnerability has been used in ransomware attacks, but the risk of misuse is high. Organizations using Zimbra Collaboration should follow the mitigation recommendations from Synacor.
If mitigations are not available, it’s strongly advised to stop using the product. CISA has set a deadline for remediation by October 24, 2024, highlighting the urgency.
CVE-2024-29824: Ivanti Endpoint Manager SQL Injection Vulnerability:
The Ivanti Endpoint Manager (EPM) is at risk because of a SQL injection vulnerability called CVE-2024-29824.
This vulnerability lets unauthenticated attackers on the same network execute arbitrary code on the Core server. Like the Zimbra issue, there’s no evidence of it being exploited in ransomware attacks yet, but the risk is still significant.
Ivanti has provided guidance to address this vulnerability, and organizations should follow it quickly. The deadline to implement these measures is October 23, 2024.
CISA’s alert emphasizes the serious nature of these vulnerabilities and their potential global impact on organizations.
Synacor and Ivanti emphasize the need for quick action to safeguard sensitive data and ensure operational integrity.