InfoSecBulletin Cybersecurity for mankind
Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC) to fix several vulnerabilities, including three critical issues.
The company discovered the flaws via its responsible disclosure program from CISA, Akamai, and the HackerOne bug bounty platform.
AWS SNS misused for Data Exfiltration and Phishing
Researcher found non protected database form ESHYFT containig 86000 records
CVE-2024-55591 and CVE-2025-24472
New SuperBlack ransomware exploits Fortinet flaws
CVE-2025-25291 & CVE-2025-25292
Attention! GitLab Patched Critical Authentication Bypass Flaws
CVE-2025-20138
Cisco released High Security Alert for IOS XR Software
400+ IPs Exploiting Multiple SSRF Vulnerabilities
NVIDIA has released update for NVIDIA Riva
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
Ivanti’s security bulletin states that there are no known active exploits for the reported issues, but it advises users to install security updates promptly.
The three critical security vulnerabilities Ivanti patched are the following:
CVE-2025-22467: A stack-based buffer overflow in ICS lets remote authenticated users with low privileges execute code, with a critical severity score of 9.9.
CVE-2024-38657: External control of filenames allows remote authenticated attackers to write arbitrary files in ICS and IPS, with a critical severity score of 9.1.
CVE-2024-10644: A code injection vulnerability allows remote authenticated attackers to execute code in ICS and IPS systems, with a critical severity score of 9.1.
The bulletin lists five additional flaws with medium to high severity, including cross-site scripting (XSS), hardcoded keys, insecure storage of sensitive data, and inadequate permissions.
The vulnerabilities affect ICS 22.7R2.5 and earlier, IPS 22.7R1.2 and earlier, and ISAC 22.7R4 and earlier. For specific impacted products, refer to the table below.
Issues have been resolved in ICS version 22.7R2.6, IPS version 22.7R1.3, and ISAC 22.8R1. These are the recommended upgrades for system administrators.
