CVE-2024-7570

CVE-2024-7570

Título es
CVE-2024-7570

Mar, 13/08/2024 – 19:15

Tipo
CWE-295

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2024-7570

Descripción en
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a token that would allow access to ITSM as any user.

13/08/2024
13/08/2024
Vector CVSS:3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Gravedad 3.1 (CVSS 3.1 Base Score)
8.30

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
HIGH

Referencias

  • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570

    • Enviar en el boletín
    Off

    CVE-2024-7569

    CVE-2024-7569

    Título es
    CVE-2024-7569

    Mar, 13/08/2024 – 19:15

    Tipo
    CWE-215

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-7569

    Descripción en
    An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    9.60

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    CRITICAL

    Referencias

  • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570

    • Enviar en el boletín
    Off

    CVE-2024-7739

    CVE-2024-7739

    Título es
    CVE-2024-7739

    Mar, 13/08/2024 – 19:15

    Tipo
    CWE-79

    Gravedad v2.0
    5.00

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2024-7739

    Descripción en
    A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

    Vector CVSS:2.0
    AV:N/AC:L/Au:N/C:N/I:P/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4


  • https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md

  • https://vuldb.com/?ctiid_274359=

  • https://vuldb.com/?id_274359=

  • https://vuldb.com/?submit_385635=

    • Enviar en el boletín
    Off

    CVE-2024-7738

    CVE-2024-7738

    Título es
    CVE-2024-7738

    Mar, 13/08/2024 – 19:15

    Tipo
    CWE-21

    Gravedad v2.0
    1.70

    Gravedad 2.0 Txt
    LOW

    Título en

    CVE-2024-7738

    Descripción en
    A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

    Vector CVSS:2.0
    AV:L/AC:L/Au:S/C:P/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    3.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    LOW

    Referencias

  • https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/file_read_report.md

  • https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/poc_arbitrary_file_read.mp4


  • https://vuldb.com/?ctiid_274358=

  • https://vuldb.com/?id_274358=

  • https://vuldb.com/?submit_385634=

    • Enviar en el boletín
    Off

    CVE-2024-38144

    CVE-2024-38144

    Título es
    CVE-2024-38144

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-190

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38144

    Descripción en
    Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    8.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38144

    • Enviar en el boletín
    Off

    CVE-2024-38143

    CVE-2024-38143

    Título es
    CVE-2024-38143

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-306

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38143

    Descripción en
    Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.20

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38143

    • Enviar en el boletín
    Off

    CVE-2024-38150

    CVE-2024-38150

    Título es
    CVE-2024-38150

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-416

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38150

    Descripción en
    Windows DWM Core Library Elevation of Privilege Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38150

    • Enviar en el boletín
    Off

    CVE-2024-38148

    CVE-2024-38148

    Título es
    CVE-2024-38148

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-125

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38148

    Descripción en
    Windows Secure Channel Denial of Service Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38148

    • Enviar en el boletín
    Off

    CVE-2024-38147

    CVE-2024-38147

    Título es
    CVE-2024-38147

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-416

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38147

    Descripción en
    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38147

    • Enviar en el boletín
    Off

    CVE-2024-38146

    CVE-2024-38146

    Título es
    CVE-2024-38146

    Mar, 13/08/2024 – 18:15

    Tipo
    CWE-476

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-38146

    Descripción en
    Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability

    13/08/2024
    13/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38146

    • Enviar en el boletín
    Off