This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2024-37397.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Alternatively, no user interaction is required if the attacker has administrative credentials to the application. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-8191.
frr-8.5.5-2.fc39
Fix for CVE-2024-44070
It was discovered that Unbound incorrectly handled string comparisons,
which could lead to a NULL pointer dereference. An attacker could
potentially use this issue to cause a denial of service. (CVE-2024-43167)
It was discovered that Unbound incorrectly handled memory in
cfg_mark_ports, which could lead to a heap buffer overflow. A local
attacker could potentially use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-43168)
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Posted by KoreLogic Disclosures via Fulldisclosure on Sep 10
KL-001-2024-012: VICIdial Authenticated Remote Code Execution
Title: VICIdial Authenticated Remote Code Execution
Advisory ID: KL-001-2024-012
Publication Date: 2024-09-10
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-012.txt
1. Vulnerability Details
Affected Vendor: VICIdial
Affected Product: VICIdial
Affected Version: 2.14-917a
Platform: GNU/Linux
CWE Classification:…
Posted by KoreLogic Disclosures via Fulldisclosure on Sep 10
KL-001-2024-011: VICIdial Unauthenticated SQL Injection
Title: VICIdial Unauthenticated SQL Injection
Advisory ID: KL-001-2024-011
Publication Date: 2024-09-10
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-011.txt
1. Vulnerability Details
Affected Vendor: VICIdial
Affected Product: VICIdial
Affected Version: 2.14-917a
Platform: GNU/Linux
CWE Classification: CWE-89:…
frr-9.1.1-2.fc40
Fix for CVE-2024-44070
python3.6-3.6.15-37.fc40
Security fix for CVE-2024-6232 (rhbz#2310092)
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
