article thumbnail

CVE-2023-38035: Ivanti Sentry API Authentication Bypass Zero-Day Exploited in the Wild

Tenable

CVE Description CVSSv3 Severity CVE-2023-38035 Ivanti Sentry API Authentication Bypass Vulnerability 9.8 Critical Disclosure of this vulnerability is credited to researchers at mnemonic, which published its own blog post about the discovery. Just like CVE-2023-38035, its discovery is also credited to researchers at mnemonic.

article thumbnail

CVE-2023-35078: Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core Unauthenticated API Access Vulnerability

Tenable

CVE Description CVSSv3 Severity CVE-2023-35078 Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability 10.0 Analysis CVE-2023-35078 is an authentication bypass vulnerability in Ivanti’s EPMM. Tenable was provided access to the support article and our blog post reflects what we currently know about this vulnerability.

Mobile 98
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Cybersecurity Snapshot: Cyber Pros Say How AI Is Changing Their Work, While the FBI Reports Ransomware Hit Critical Infrastructure Hard in 2023

Tenable

of the “Insider Threat TTP Knowledge Base” now includes mitigation recommendations for each one of the techniques in the database. The most common mitigations included are foundational practices, such as account management, multi-factor authentication, auditing, and disabling or removal of features or programs. What’s new?

article thumbnail

Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD

Tenable

Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Protect email and other digital accounts with multi-factor authentication. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. And much more!

article thumbnail

CVE-2023-20864: VMware Aria Operations for Logs Deserialization Vulnerability

Tenable

This blog post was published on April 21 and reflects VPR at that time. An attacker that has authenticated to a vulnerable VMware Aria Operations for Logs instance with administrative privileges could exploit this vulnerability to gain arbitrary code execution with root privileges. Solution VMware has released version 8.12

article thumbnail

CVE-2020-12271: Zero-Day SQL Injection Vulnerability in Sophos XG Firewall Exploited in the Wild

Tenable

On April 22, Sophos published a knowledge base entry on the Sophos Community regarding the discovery of a zero-day vulnerability in the Sophos XG Firewall that was exploited in the wild. CVE-2020-12271 is a pre-authentication SQL injection vulnerability that exists in the Sophos XG Firewall/Sophos Firewall Operating System (SFOS).

Firewall 101
article thumbnail

CVE-2021-22986: F5 Patches Several Critical Vulnerabilities in BIG-IP, BIG-IQ

Tenable

F5 releases patches for multiple vulnerabilities in BIG-IP and BIG-IQ, including a critical remote command execution flaw that does not require authentication and is likely to attract exploits in the near future. Knowledge Base Article. Tenable Blog Post for CVE-2020-5902 (July 2020). Background. CVE-2021-22986.