Patch/Configuration Management

Arbitrary file upload is made possible by a missing file type validation.

Insufficient policy enforcement could lead to data disclosure when loading malicious resources.

We are losing the scan-patch battle – and that has to change.

SecurityWeek reports that updates have been issued by Ivanti to address a pair of zero-day vulnerabilities in its Endpoint Manager Mobile offering, which have been chained in ongoing attacks that were confirmed to have impacted very few of its customers.

The EUVD, maintained by ENISA, compiles information from the CVE program, CSIRTs and vendors.

A second zero-day flaw was found in addition to exploitation of Netweaver by ransomware groups.