Cyberark Endpoint Privilege Manager
5 CVEs affecting Cyberark Endpoint Privilege Manager. Latest disclosed: 2025-02-28. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22274 | | 2025-02-28 | It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint… | |
CVE-2025-22273 | | 2025-02-28 | Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword"… | |
CVE-2025-22272 | | 2025-02-28 | In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is th… | |
CVE-2025-22271 | | 2025-02-28 | The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mecha… | |
CVE-2025-22270 | | 2025-02-28 | An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It shoul… |