IVANTI WARNS OF NEW ZERO-DAY ATTACKS HITTING CONNECT SECURE PRODUCT

Summary from the TLDR InfoSec newsletter

Ivanti has announced two high severity vulnerabilities in Ivanti Secure Connect appliances. The first vulnerability is a stack-based buffer overflow that allows unauthenticated, remote attackers to execute arbitrary code. The second vulnerability is a privilege escalation vulnerability for local, authenticated attackers. Ivanti says that the first vulnerability is being actively exploited and urges customers to update vulnerable devices.