Septembre 2024

Ivanti CSA (Cloud Services Appliance) · ivanti endpoint_manager_cloud_services_appliance · Ivanti endpoint manager cloud services appliance

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

PTZOptics PT30X-SDI · PTZOptics PT30X-NDI · ptzoptics pt30x-sdi_firmware · ptzoptics pt30x-ndi-xx-g2_firmware

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.

Veeam Backup and Recovery · veeam backup_\&_replication · Veeam veeam backup \& replication

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Cisco Smart License Utility · cisco_smart_license_utility

A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.