Aug 22, 2023

Started

• Closed✓Patched

  Ivanti Sentry: Authentication Bypass (CVE-2023-38035)

  Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.

  Ivanti Sentry·Closed Aug 22, 2023·updated Aug 22, 2023

• Closed✓Patched

  Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)

  Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. Added to CISA KEV on 2023-08-22. CISA lists known use in ransomware campaigns.

  Veeam Backup & Replication·Closed Aug 22, 2023·updated Aug 22, 2023