CVE Vulnerability Advisory Database

[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted API requests, leading to full system compromise

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to the management API

[Affected Scope] Cisco Catalyst SD-WAN Manager (formerly vManage) API interface

[Impact] Authenticated remote attackers with read-only API credentials can overwrite arbitrary files on the local file system and gain vmanage user privileges

[Mitigation] Apply official Cisco security patches immediately, restrict API access, and audit API permissions for low-privileged accounts

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior

[Impact] Authenticated attackers can execute arbitrary code with elevated privileges via crafted API requests, potentially leading to full system compromise.

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict external access to the API endpoints.

[Affected Scope] Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) versions 11.4, 11.10, 11.11, and all older/supported releases

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted API endpoints, allowing them to harvest sensitive personally identifiable information (PII) or create unauthorized administrative accounts

[Mitigation] Immediately apply the official security patches or upgrade to Ivanti EPMM version 11.12 or higher, and restrict external access to administrative interfaces