Wednesday , April 2 2025
ivanti

(CVE-2024-7569 and CVE-2024-7570)
Ivanti flags Critical Fixes for ITSM Vulnerabilities

Ivanti issued a security advisory about two important vulnerabilities in its Neurons for IT Service Management (ITSM) platform. Customers using the on-premise version should act quickly. The vulnerabilities (CVE-2024-7569 and CVE-2024-7570) affect Ivanti Neurons for ITSM versions 2023.4 and older, putting them at risk of unauthorized data access and system compromise.

Vulnerabilities and Potential Impacts:

Check Point said BreachForum post old data

Israeli cybersecurity firm Check Point has responded to a hacker who claimed to have stolen valuable information from its systems....
Read More
Check Point said BreachForum post old data

Apple Warns of 3 Zero Day Vulns Actively Exploited

Apple has issued an urgent security advisory about 3 critical zero-day vulnerabilities—CVE-2025-24200, CVE-2025-24201, and CVE-2025-24085—that are being actively exploited in...
Read More
Apple Warns of 3 Zero Day Vulns Actively Exploited

24,000 unique IP attempted to access Palo Alto GlobalProtect portals

GreyNoise has detected a sharp increase in login scanning aimed at Palo Alto Networks PAN-OS GlobalProtect portals. In the past...
Read More
24,000 unique IP attempted to access Palo Alto GlobalProtect portals

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

Vulnerability CVE-2024-7569 has a high severity score of 9.6. It allows an unauthenticated attacker to access the OIDC client secret through exposed debug information, which could lead to unauthorized access to sensitive information within the ITSM environment.

The vulnerability is a big concern for organizations that use OIDC authentication in their ITSM systems. If the client secret is exposed, the authentication process could be compromised. This means attackers could pretend to be real users or services.

The second vulnerability, CVE-2024-7570, has a CVSS score of 8.3 and stems from the improper validation of certificates in Ivanti Neurons for ITSM. This weakness allows a malicious actor positioned in the Man-in-the-Middle (MITM) to create a harmful token, which grants undesired access to the ITSM system, posing as any user. The repercussions of this vulnerability are extremely grave, as unauthorized access, data manipulation, or even the critical disruption of IT services can occur.

Patch Availability and Urgency for On-Premise Customers:

Ivanti has fixed vulnerabilities in their cloud-based Ivanti Neurons for ITSM as of August 4, protecting cloud customers. On-premise customers using versions 2023.4 and earlier should apply the available patches quickly to reduce the risks from these vulnerabilities.

Impact and Recommendations:

These vulnerabilities affect customers using Ivanti Neurons for ITSM with OIDC authentication. Ivanti hasn’t seen these vulnerabilities being exploited, but it’s important to act quickly due to the critical nature of the issues.

Check Also

200 million

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives’ Cybersecurity Team found a forum post where a threat actor shared a .CSV …

Leave a Reply

Your email address will not be published. Required fields are marked *