Ivanti
Page 3 of 4 — Ivanti CVEs from a corpus of 391, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-29821 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-29213 | High | 7.8 | 2024-10-18 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vec… |
CVE-2024-9381 | High | 7.2 | 2024-10-08 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. |
CVE-2024-9380 | High | 7.2 | 2024-10-08 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges… |
CVE-2024-9379 | Medium | 6.5 | 2024-10-08 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL sta… |
CVE-2024-9167 | High | 7.8 | 2024-10-08 | Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local… |
CVE-2024-7612 | High | 8.8 | 2024-10-08 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. |
CVE-2024-47011 | High | 7.5 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information |
CVE-2024-47010 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47009 | High | 7.3 | 2024-10-08 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-47008 | High | 7.5 | 2024-10-08 | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. |
CVE-2024-47007 | High | 7.5 | 2024-10-08 | A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of ser… |
CVE-2024-8963 | Critical | 9.4 | 2024-09-19 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
CVE-2024-37397 | High | 8.2 | 2024-09-12 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen… |
CVE-2024-34785 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34783 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-34779 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32848 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32846 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32845 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32843 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32842 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-32840 | High | 7.2 | 2024-09-12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev… |
CVE-2024-29847 | Critical | 9.8 | 2024-09-12 | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to a… |
CVE-2024-8441 | Medium | 6.7 | 2024-09-10 | An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privilege… |
CVE-2024-8322 | Medium | 4.3 | 2024-09-10 | Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted… |
CVE-2024-8321 | Medium | 5.8 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate man… |
CVE-2024-8320 | Medium | 5.3 | 2024-09-10 | Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Netwo… |
CVE-2024-8191 | High | 7.8 | 2024-09-10 | SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote… |
CVE-2024-8190 | High | 7.2 | 2024-09-10 | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain rem… |
CVE-2024-8012 | High | 7.8 | 2024-09-10 | An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated atta… |
CVE-2024-44107 | High | 8.8 | 2024-09-10 | DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their p… |
CVE-2024-44106 | High | 8.8 | 2024-09-10 | Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker… |
CVE-2024-44105 | High | 8.2 | 2024-09-10 | Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authent… |
CVE-2024-44104 | High | 8.8 | 2024-09-10 | An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 20… |
CVE-2024-44103 | High | 8.8 | 2024-09-10 | DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their p… |
CVE-2024-38653 | High | 7.5 | 2024-08-14 | XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. |
CVE-2024-38652 | Critical | 9.1 | 2024-08-14 | Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary f… |
CVE-2024-37399 | High | 7.5 | 2024-08-14 | A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. |
CVE-2024-37373 | High | 7.2 | 2024-08-14 | Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE. |
CVE-2024-36136 | High | 7.5 | 2024-08-14 | An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS. |
CVE-2024-7593 | Critical | 9.8 | 2024-08-13 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a… |
CVE-2024-7570 | High | 8.3 | 2024-08-13 | Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a… |
CVE-2024-7569 | Critical | 9.6 | 2024-08-13 | An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain th… |
CVE-2024-37403 | Medium | 5.5 | 2024-08-07 | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting i… |
CVE-2024-36132 | High | 7.5 | 2024-08-07 | Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. |
CVE-2024-36131 | High | 8.8 | 2024-08-07 | An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbitrary commands on t… |
CVE-2024-36130 | Critical | 9.8 | 2024-08-07 | An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary… |
CVE-2024-34788 | Medium | 6.5 | 2024-08-07 | An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information |
CVE-2024-37381 | High | 8.0 | 2024-07-29 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary… |
CVE-2024-29848 | High | 7.2 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary comma… |
CVE-2024-29846 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29830 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29829 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29828 | High | 8.0 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute… |
CVE-2024-29827 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29826 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29825 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29824 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29823 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-29822 | High | 8.8 | 2024-05-31 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut… |
CVE-2024-22060 | Medium | 4.9 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary f… |
CVE-2024-22059 | High | 8.8 | 2024-05-31 | A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlyin… |
CVE-2024-22058 | High | 7.8 | 2024-05-31 | A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivan… |
CVE-2023-46810 | High | 7.3 | 2024-05-31 | A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute code as root. |
CVE-2023-38551 | High | 8.2 | 2024-05-31 | A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser… |
CVE-2023-38042 | High | 7.8 | 2024-05-31 | A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM. |
CVE-2024-22026 | Medium | 6.7 | 2024-05-22 | A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary command… |
CVE-2023-46807 | Medium | 6.7 | 2024-05-22 | An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the… |
CVE-2023-46806 | Medium | 6.7 | 2024-05-22 | An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify… |
CVE-2023-34298 | High | 7.8 | 2024-05-03 | Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2024-29205 | High | 7.5 | 2024-04-25 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x… |
CVE-2024-23527 | High | 7.5 | 2024-04-25 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-29204 | Critical | 9.8 | 2024-04-19 | A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary co… |
CVE-2024-27984 | High | 7.1 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or… |
CVE-2024-27978 | Medium | 6.5 | 2024-04-19 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform de… |
CVE-2024-27977 | High | 8.1 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby lead… |
CVE-2024-27976 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-27975 | High | 8.8 | 2024-04-19 | An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary co… |
CVE-2024-25000 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24999 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24998 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24997 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24996 | Critical | 9.8 | 2024-04-19 | A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary co… |
CVE-2024-24995 | High | 7.5 | 2024-04-19 | A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands… |
CVE-2024-24994 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-24993 | High | 7.5 | 2024-04-19 | A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands… |
CVE-2024-24992 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. |
CVE-2024-24991 | Medium | 6.5 | 2024-04-19 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform de… |
CVE-2024-23535 | High | 8.8 | 2024-04-19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM… |
CVE-2024-23534 | High | 8.8 | 2024-04-19 | An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary command… |
CVE-2024-23533 | Medium | 6.5 | 2024-04-19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote a… |
CVE-2024-23532 | High | 7.5 | 2024-04-19 | An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial… |
CVE-2024-23531 | High | 7.5 | 2024-04-19 | An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial o… |
CVE-2024-23530 | High | 7.5 | 2024-04-19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-23529 | High | 7.5 | 2024-04-19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-23528 | High | 7.5 | 2024-04-19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-23526 | High | 7.5 | 2024-04-19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote… |
CVE-2024-22061 | Critical | 9.8 | 2024-04-19 | A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary com… |
CVE-2024-21894 | Critical | 9.8 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |