Critical vulnerability in Manage Engine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024

Summary: Cisco Talos disclosed dozens of vulnerabilities over the past month, including a critical 9.1-severity directory traversal in ManageEngine OpManager (CVE-2023-47211) that lets an attacker create a file outside the default MiBs directory via a crafted HTTP request, and 33 advisories covering more than 80 CVEs in the GTKWave simulation tool. Talos also reported an information disclosure flaw in DuoUniversalKeycloakAuthenticator (CVE-2023-49594) that sends the username and password to the duosecurity.com endpoint on each redirect, and multiple AVideo vulnerabilities, the most serious being a local file inclusion flaw (CVE-2023-47862) scored 9.8 out of 10 that could lead to arbitrary code execution.
Why it matters: The AVideo flaws chain into full account takeover: an insufficient entropy bug (CVE-2023-49589) lets an attacker forge an administrator password reset, and CVE-2023-50172 suppresses the email alert so the reset goes unnoticed.

Read the original at Cisco Talos ↗