Ivanti
Page 4 of 4 — Ivanti CVEs from a corpus of 391, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-22053 | High | 8.2 | 2024-04-04 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send… |
CVE-2024-22052 | High | 7.5 | 2024-04-04 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious u… |
CVE-2024-22023 | Medium | 5.3 | 2024-04-04 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker… |
CVE-2023-46808 | Critical | 9.9 | 2024-03-31 | An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation ma… |
CVE-2023-41724 | High | 8.8 | 2024-03-31 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin… |
CVE-2024-22024 | High | 8.3 | 2024-02-13 | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which… |
CVE-2024-21893 | High | 8.2 | 2024-01-31 | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons… |
CVE-2024-21888 | High | 8.8 | 2024-01-31 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privil… |
CVE-2023-41474 | Medium | 6.5 | 2024-01-25 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.reso… |
CVE-2024-21887 | Critical | 9.1 | 2024-01-12 | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administ… |
CVE-2023-46805 | High | 8.2 | 2024-01-12 | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted reso… |
CVE-2023-39336 | High | 8.8 | 2024-01-09 | An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to ex… |
CVE-2023-46804 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46803 | High | 7.5 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). |
CVE-2023-46266 | Critical | 9.1 | 2023-12-19 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
CVE-2023-46265 | Critical | 9.8 | 2023-12-19 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). |
CVE-2023-46264 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-46263 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote… |
CVE-2023-46262 | High | 7.5 | 2023-12-19 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control serve… |
CVE-2023-46261 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46260 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46259 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46258 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46257 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46225 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46224 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46223 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46222 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46221 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46220 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46217 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46216 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-41727 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2021-22962 | Critical | 9.1 | 2023-12-19 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. |
CVE-2023-39340 | High | 7.5 | 2023-12-16 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service… |
CVE-2023-41720 | High | 7.8 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can… |
CVE-2023-41719 | High | 7.2 | 2023-12-14 | A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a specific web request… |
CVE-2023-41718 | High | 7.8 | 2023-11-15 | When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a… |
CVE-2023-39337 | Critical | 9.1 | 2023-11-15 | A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extrac… |
CVE-2023-39335 | Critical | 9.8 | 2023-11-15 | A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existi… |
CVE-2023-38544 | Medium | 5.5 | 2023-11-15 | A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited t… |
CVE-2023-38543 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-38043 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-35080 | High | 7.8 | 2023-11-15 | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable conf… |
CVE-2023-41726 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability |
CVE-2023-41725 | High | 7.8 | 2023-11-03 | Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability |
CVE-2022-44569 | High | 7.8 | 2023-11-03 | A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication. |
CVE-2022-43555 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2022-43554 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2023-38041 | High | 7.0 | 2023-10-25 | A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an… |
CVE-2023-35084 | Critical | 9.8 | 2023-10-18 | Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which co… |
CVE-2023-35083 | Medium | 6.5 | 2023-10-18 | Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions pote… |
CVE-2023-38344 | Medium | 6.5 | 2023-09-21 | An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /land… |
CVE-2023-38343 | High | 7.5 | 2023-09-21 | An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are en… |
CVE-2023-38035 | Critical | 9.8 | 2023-08-21 | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication contr… |
CVE-2023-35082 | Critical | 9.8 | 2023-08-15 | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the applica… |
CVE-2023-32565 | Critical | 9.1 | 2023-08-10 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4… |
CVE-2023-32564 | Critical | 9.8 | 2023-08-10 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-32563 | Critical | 9.8 | 2023-08-10 | An unauthenticated attacker could achieve the code execution through a RemoteControl server. |
CVE-2023-32562 | Critical | 9.8 | 2023-08-10 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove… |
CVE-2023-32561 | High | 7.5 | 2023-08-10 | A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed… |
CVE-2023-32560 | Critical | 9.8 | 2023-08-10 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Than… |
CVE-2023-28129 | High | 7.8 | 2023-08-10 | DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user. |
CVE-2023-32567 | Critical | 9.8 | 2023-08-10 | Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236 |
CVE-2023-32566 | Critical | 9.1 | 2023-08-10 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4… |
CVE-2023-35081 | High | 7.2 | 2023-08-03 | A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to… |
CVE-2023-35078 | Critical | 9.8 | 2023-07-25 | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without prop… |
CVE-2023-35077 | High | 7.5 | 2023-07-21 | An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 o… |
CVE-2023-28324 | Critical | 9.8 | 2023-07-01 | A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. |
CVE-2023-28323 | Critical | 9.8 | 2023-07-01 | A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could pot… |
CVE-2023-28128 | High | 7.2 | 2023-05-09 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove… |
CVE-2023-28127 | High | 7.5 | 2023-05-09 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. |
CVE-2023-28126 | Medium | 5.9 | 2023-05-09 | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser metho… |
CVE-2023-28125 | Medium | 5.9 | 2023-05-09 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by regi… |
CVE-2022-36983 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit th… |
CVE-2022-36982 | High | 7.5 | 2023-03-29 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required… |
CVE-2022-36981 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is requir… |
CVE-2022-36980 | High | 8.1 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requir… |
CVE-2022-36979 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requir… |
CVE-2022-36978 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36977 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36976 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within t… |
CVE-2022-36975 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within t… |
CVE-2022-36974 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-36973 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requir… |
CVE-2022-36972 | Critical | 9.8 | 2023-03-29 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within t… |
CVE-2022-36971 | High | 8.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is requi… |
CVE-2022-44574 | High | 7.5 | 2023-03-10 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. |
CVE-2022-35259 | High | 7.8 | 2022-12-05 | XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges. |
CVE-2022-35258 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-35254 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-27773 | Critical | 9.8 | 2022-12-05 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. |
CVE-2022-21826 | Medium | 5.4 | 2022-09-30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the req… |
CVE-2022-30121 | Medium | 6.7 | 2022-09-23 | The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a securit… |
CVE-2021-44720 | High | 7.2 | 2022-08-12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Config… |
CVE-2022-22572 | High | 8.8 | 2022-04-11 | A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic… |
CVE-2022-22571 | Medium | 4.8 | 2022-04-11 | An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions. |
CVE-2022-27088 | High | 7.8 | 2022-04-11 | Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges. |
CVE-2021-30497 | High | 7.5 | 2022-04-06 | Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed… |
CVE-2022-21828 | High | 7.2 | 2022-03-04 | A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vec… |