Ivanti vulnerabilities
The newest vulnerabilities affecting Ivanti, up to 200. Subscribe by RSS.
- CVE-2026-111357Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege eIvanti Connect Secure
- CVE-2026-109412An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication infIvanti Neurons Patch for Intune
- CVE-2026-106047A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated Ivanti Xtraction
- CVE-2026-106043A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacIvanti Xtraction
- CVE-2026-106042An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to rIvanti Xtraction
- CVE-2026-106035An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated aIvanti Xtraction
- CVE-2026-106034A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitraryIvanti Xtraction
- CVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.Ivanti Connect Secure
- CVE-2026-12647A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cIvanti Neurons for ITSM
- CVE-2026-12646A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cIvanti Neurons for ITSM
- CVE-2026-12645A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary cIvanti Neurons for ITSM
- CVE-2026-83527An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain adminiIvanti Sentry
- CVE-2026-12648A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeIvanti Neurons for ITSM
- CVE-2026-12650A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeIvanti Neurons for ITSM
- CVE-2026-12651A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to executeIvanti Neurons for ITSM
- CVE-2026-12745A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execuIvanti Neurons for ITSM
- CVE-2026-12744A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execuIvanti Neurons for ITSM
- CVE-2026-18851Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacIvanti Endpoint Manager Mobile
- CVE-2026-18129Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticatIvanti Endpoint Manager
- CVE-2026-18127External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full wrIvanti Endpoint Manager
- CVE-2026-18125An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an aIvanti Endpoint Manager
- CVE-2026-14903Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web rivanti Xtraction
- CVE-2026-14902An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary externaivanti Xtraction
- CVE-2026-10727An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker Ivanti Endpoint Manager Mobile
- CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthentivanti Sentry
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated userivanti Sentry
- CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain aIvanti Neurons for ITSM
- CVE-2026-8992An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to exivanti Secure Access Client
- CVE-2026-8111SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remoteivanti Endpoint Manager
- CVE-2026-8110Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to esivanti Endpoint Manager
- CVE-2026-8109An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to ivanti Endpoint Manager
- CVE-2026-8051OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges toivanti Virtual Traffic Manager
- CVE-2026-7432A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMivanti Secure Access Client
- CVE-2026-7431An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user toivanti Secure Access Client
- CVE-2026-8043External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files andivanti Xtraction
- CVE-2026-5787An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker Ivanti Endpoint Manager Mobile
- CVE-2026-5788An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invokIvanti Endpoint Manager Mobile
- CVE-2026-7821Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to Ivanti Endpoint Manager Mobile
- CVE-2026-6973An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with adminIvanti Endpoint Manager Mobile
- CVE-2026-5786An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacIvanti Endpoint Manager Mobile
- CVE-2026-4914Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessiIvanti Neurons for ITSM
- CVE-2026-4913Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenIvanti Neurons for ITSM
- CVE-2026-3483An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Ivanti Desktop and Server Management
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedIvanti Endpoint Manager
- CVE-2026-1602SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2026-1340A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.Ivanti Endpoint Manager Mobile
- CVE-2026-1281A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.Ivanti Endpoint Manager Mobile
- CVE-2025-13662Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1Ivanti Endpoint Manager
- CVE-2025-13661Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outsIvanti Endpoint Manager
- CVE-2025-13659Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticIvanti Endpoint Manager
- CVE-2025-10573Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptIvanti Endpoint Manager
- CVE-2025-10918Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write Ivanti Endpoint Manager
- CVE-2025-10986Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker withIvanti Endpoint Manager Mobile
- CVE-2025-10985OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeIvanti Endpoint Manager Mobile
- CVE-2025-10243OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeIvanti Endpoint Manager Mobile
- CVE-2025-10242OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attackeIvanti Endpoint Manager Mobile
- CVE-2025-62384SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62386SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62383SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62391SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62385SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62387SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62388SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62389SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62390SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62392SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-11623SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-9713Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.Ivanti Endpoint Manager
- CVE-2025-11622Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privilegIvanti Endpoint Manager
- CVE-2025-55144Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55143Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforeIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55142Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55141Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55139SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55148Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55147CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55146An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway beforIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-55145Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.Ivanti Connect Secure 22.7R2.9 · Ivanti Policy Secure +2
- CVE-2025-8711CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-8712Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22Ivanti Connect Secure before · Ivanti Policy Secure +2
- CVE-2025-9872Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toIvanti Endpoint Manager
- CVE-2025-9712Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker toIvanti Endpoint Manager
- CVE-2025-5468Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, IvantiIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-5466XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and IvaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-5462A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway beIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-5456A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA GatewaIvanti Connect Secure · Ivanti Policy Secure +2
- CVE-2025-8310Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticatIvanti Virtual Application Delivery ControllerCWE-862
- CVE-2025-8297Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privIvanti Avalanche
- CVE-2025-8296SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrarIvanti Avalanche
- CVE-2023-39339A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fiIvanti Policy Secure
- CVE-2023-39338Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the senIvanti Sentry
- CVE-2024-38648A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uIvanti DSM
- CVE-2023-38036A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overfIvanti Avalanche
- CVE-2025-6771OS command injection in Ivanti Endpoint ManagerIvanti Endpoint Manager Mobile
- CVE-2025-0292SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attackeIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-0293CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticatIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-5464Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker toIvanti Connect Secure
- CVE-2025-6770OS command injection in Ivanti Endpoint ManagerIvanti Endpoint Manager Mobile
- CVE-2025-5463Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2025-5451A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-5450Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure beIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-7037SQL injection in Ivanti Endpoint ManagerIvanti Endpoint Manager
- CVE-2025-6996Improper Encryption in Ivanti Endpoint ManagerIvanti Endpoint Manager
- CVE-2025-6995Improper Encryption in Ivanti Endpoint ManagerIvanti Endpoint Manager
- CVE-2025-5353A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentialIvanti Workspace Control
- CVE-2025-22463A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environmenIvanti Workspace Control
- CVE-2025-22455A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentialsIvanti Workspace Control
- CVE-2025-4428Remote Code ExecutionIvanti Endpoint Manager Mobile
- CVE-2025-4427Authentication BypassIvanti Endpoint Manager Mobile
- CVE-2025-22462An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows Ivanti Neurons for ITSM
- CVE-2025-22460Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privilIvanti CSA
- CVE-2025-43716A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.Ivanti LANDesk Management Suite
- CVE-2025-22466Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtaIvanti Endpoint Manager
- CVE-2025-22465Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execIvanti Endpoint Manager
- CVE-2025-22464An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacIvanti Endpoint Manager
- CVE-2025-22461SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admiIvanti Endpoint Manager
- CVE-2025-22459Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticateIvanti Endpoint Manager
- CVE-2025-22458DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to Ivanti Endpoint Manager
- CVE-2025-22457A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTAIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-22454Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their Ivanti Secure Access Client
- CVE-2024-38657External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-13813Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary fileIvanti Secure Access Client
- CVE-2024-13843Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-13842A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticatIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-13830Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticaIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-12058External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-10644Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticatIvanti Connect Secure · Ivanti Policy Secure
- CVE-2025-22467A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote codeIvanti Connect Secure
- CVE-2024-11771Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.Ivanti Cloud Services Application
- CVE-2024-47908OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilegeIvanti Cloud Services Application
- CVE-2024-13162SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticIvanti Endpoint Manager
- CVE-2024-13163Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowIvanti Endpoint Manager
- CVE-2024-13164An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a locaIvanti Endpoint Manager
- CVE-2024-13165An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote Ivanti Endpoint Manager
- CVE-2024-13166An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote Ivanti Endpoint Manager
- CVE-2024-13167An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote Ivanti Endpoint Manager
- CVE-2024-13168An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote Ivanti Endpoint Manager
- CVE-2024-13169An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local auIvanti Endpoint Manager
- CVE-2024-13170An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote Ivanti Endpoint Manager
- CVE-2024-13171Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowsIvanti Endpoint Manager
- CVE-2024-13172Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows Ivanti Endpoint Manager
- CVE-2024-13158An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowIvanti Endpoint Manager
- CVE-2024-13159Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-13160Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-13161Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-10811Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteIvanti Endpoint Manager
- CVE-2024-13181Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.Ivanti Avalanche
- CVE-2024-13180Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information.Ivanti Avalanche
- CVE-2024-13179Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.Ivanti Avalanche
- CVE-2024-10630A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the applicatiIvanti Application Control Engine
- CVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2025-0282A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti NeuIvanti Connect Secure · Ivanti Policy Secure +1
- CVE-2024-37401An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial oIvanti Connect Secure
- CVE-2024-37377A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a dIvanti Connect Secure
- CVE-2024-11598Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allowsIvanti Application Control
- CVE-2024-11597Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allowsIvanti Performance Manager
- CVE-2024-8496Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attackIvanti Workspace Control
- CVE-2024-9845Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to aIvanti Automation
- CVE-2024-10251Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attackerIvanti Security Controls
- CVE-2024-11773SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ruIvanti Cloud Services Application
- CVE-2024-11772Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges tIvanti Cloud Services Application
- CVE-2024-11639An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrativeIvanti Cloud Services Application
- CVE-2024-7572Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.Ivanti Desktop and Server Management
- CVE-2024-8540Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive aIvanti Sentry
- CVE-2024-11634Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authentiIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-11633Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve Ivanti Connect Secure
- CVE-2024-9844Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticatIvanti Connect Secure
- CVE-2024-10256Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.Ivanti Patch SDK · Ivanti Endpoint Manager +4
- CVE-2024-38655Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-34784SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34780SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-29211A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratioIvanti Secure Access Client
- CVE-2024-39712Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-34781SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-37400An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop,Ivanti Connect Secure
- CVE-2024-32839SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-38654Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges toIvanti Secure Access Client
- CVE-2024-38649An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated atIvanti Connect Secure
- CVE-2024-39711Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-39709Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-38656Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-32844SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34787Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthentIvanti EPM
- CVE-2024-32847SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-37398Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.Ivanti Secure Access Client
- CVE-2024-32841SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34782SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-39710Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-37376SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-7571Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.Ivanti Secure Access Client
- CVE-2024-9843A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service.Ivanti Secure Access Client
- CVE-2024-9842Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary foldersIvanti Secure Access Client
- CVE-2024-8539Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configIvanti Secure Access Client
- CVE-2024-11004Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticaIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-11005Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-11006Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-11007Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-8495A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remoteIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-47909A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-47907A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a Ivanti Connect Secure