Ivanti on Tuesday declare to patch for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM). Ivanti resolved six out of the ten security defects resolved in EPM are critical-severity SQL Injection bugs. Tracked as CVE-2024-29822 through CVE-2024-29827, the bugs impact the Core server of Ivanti EPM 2022 SU5 scoring CVSS score of 9.
The vendor released hot fixes for EPM 2022 SU5 which resolve four other SQL injection vulnerabilities in EPM 2022 SU5 and prior releases that could also be exploited to execute arbitrary code from the network, without authentication. Ivanti also announced patches for a high-severity unrestricted file upload bug in the web component of Ivanti Avalanche.
By infosecbulletin
/ Monday , June 24 2024
LockBit claimed that it breached Federal Reserve Board (Federalreserve.gov), the central banking system of the United States and exfiltrated 33...
Read More
By infosecbulletin
/ Monday , June 24 2024
Cyber attack compromised Indonesia's national data center, causing trouble with immigration checks at airports. Attacker demanded an $8 million ransom,...
Read More
By infosecbulletin
/ Sunday , June 23 2024
ESET Issued security patch for privilege escalation flaw in its Windows security products. This flaw, called CVE-2024-2003 (CVSS 7.3), was...
Read More
By infosecbulletin
/ Saturday , June 22 2024
A threat offer to sell a zero-day exploit for Atlassian's Jira in a underground forum. This exploit can be used...
Read More
By infosecbulletin
/ Friday , June 21 2024
The US plans to ban the sale of Kaspersky antivirus software due to its alleged ties to the Kremlin. Gina...
Read More
By infosecbulletin
/ Friday , June 21 2024
A group believed to be linked to China has hacked multiple telecom operators in an Asian country since 2021, according...
Read More
By infosecbulletin
/ Thursday , June 20 2024
Certified Information Systems Auditor (CISA) is a globally recognized professional certification for information systems audit, control, and security. It's offered...
Read More
By infosecbulletin
/ Thursday , June 20 2024
DataDog Security Labs found a worrying campaign targeting Amazon Web Services (AWS), showing a new wave of harmful activity aimed...
Read More
By infosecbulletin
/ Wednesday , June 19 2024
CISA and the FBI released guidance, Modern Approaches to Network Access Security, with support from other organizations including New Zealand’s...
Read More
By infosecbulletin
/ Tuesday , June 18 2024
On June 18, 2024, CISA released an advisory about Industrial Control Systems (ICS). These advisories give important information about security...
Read More
Ivanti said, “It is highly recommended to download the Avalanche installer and update to the latest Avalanche 6.4.3.602. The installation will apply a fix for the single CVE but will also include previously released CVE fixes and security hardenings,”.
Patches were rolled out for five other high-severity vulnerabilities as well: an SQL injection and an unrestricted file upload bug in Neurons for ITSM, a CRLF injection flaw in Connect Secure, and two local privilege escalation issues in the Secure Access client for Windows.
In addition, patches have been shipped for five other high-severity vulnerabilities: an SQL injection (CVE-2024-22059) and an unrestricted file upload bug (CVE-2024-22060) in Neurons for ITSM, a CRLF injection flaw in Connect Secure (CVE-2023-38551), and two local privilege escalation issues in the Secure Access client for Windows (CVE-2023-38042) and Linux (CVE-2023-46810).
Ivanti said that there is no evidence of the flaws being exploited in the wild or that they were “introduced into our code development process maliciously” via a supply chain attack.