Category Archives: Advisories

ZDI-24-1211: Ivanti Endpoint Manager WasPreviouslyMapped SQL Injection Remote Code Execution Vulnerability

Read Time:21 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Alternatively, no user interaction is required if the attacker has administrative credentials to the application. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-8191.

Read More

USN-6998-1: Unbound vulnerabilities

Read Time:22 Second

It was discovered that Unbound incorrectly handled string comparisons,
which could lead to a NULL pointer dereference. An attacker could
potentially use this issue to cause a denial of service. (CVE-2024-43167)

It was discovered that Unbound incorrectly handled memory in
cfg_mark_ports, which could lead to a heap buffer overflow. A local
attacker could potentially use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-43168)

Read More

KL-001-2024-012: VICIdial Authenticated Remote Code Execution

Read Time:20 Second

Posted by KoreLogic Disclosures via Fulldisclosure on Sep 10

KL-001-2024-012: VICIdial Authenticated Remote Code Execution

Title: VICIdial Authenticated Remote Code Execution
Advisory ID: KL-001-2024-012
Publication Date: 2024-09-10
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt

1. Vulnerability Details

     Affected Vendor: VICIdial
     Affected Product: VICIdial
     Affected Version: 2.14-917a
     Platform: GNU/Linux
     CWE Classification:…

Read More