# cve.now: Ivanti

The newest entries affecting Ivanti (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111357](https://cve.now/CVE-2026-111357.md): Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege e (CVSS 7.0, Ivanti Connect Secure)
- [CVE-2026-109412](https://cve.now/CVE-2026-109412.md): An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication inf (CVSS 9.9, Ivanti Neurons Patch for Intune)
- [CVE-2026-106047](https://cve.now/CVE-2026-106047.md): A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated (CVSS 7.7, Ivanti Xtraction)
- [CVE-2026-106043](https://cve.now/CVE-2026-106043.md): A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attac (CVSS 7.5, Ivanti Xtraction)
- [CVE-2026-106042](https://cve.now/CVE-2026-106042.md): An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to r (CVSS 9.9, Ivanti Xtraction)
- [CVE-2026-106035](https://cve.now/CVE-2026-106035.md): An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated a (CVSS 5.5, Ivanti Xtraction)
- [CVE-2026-106034](https://cve.now/CVE-2026-106034.md): A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary (CVSS 5.0, Ivanti Xtraction)
- [CVE-2026-104935](https://cve.now/CVE-2026-104935.md): Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. (CVSS 8.6, KEV, Ivanti Connect Secure)
- [CVE-2026-12647](https://cve.now/CVE-2026-12647.md): A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary c (CVSS 9.9, Ivanti Neurons for ITSM)
- [CVE-2026-12646](https://cve.now/CVE-2026-12646.md): A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary c (CVSS 9.9, Ivanti Neurons for ITSM)
- [CVE-2026-12645](https://cve.now/CVE-2026-12645.md): A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary c (CVSS 9.9, Ivanti Neurons for ITSM)
- [CVE-2026-83527](https://cve.now/CVE-2026-83527.md): An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain admini (CVSS 8.1, Ivanti Sentry)
- [CVE-2026-12648](https://cve.now/CVE-2026-12648.md): A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute (CVSS 8.8, Ivanti Neurons for ITSM)
- [CVE-2026-12650](https://cve.now/CVE-2026-12650.md): A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute (CVSS 9.9, Ivanti Neurons for ITSM)
- [CVE-2026-12651](https://cve.now/CVE-2026-12651.md): A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute (CVSS 8.8, Ivanti Neurons for ITSM)
- [CVE-2026-12745](https://cve.now/CVE-2026-12745.md): A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execu (CVSS 9.8, Ivanti Neurons for ITSM)
- [CVE-2026-12744](https://cve.now/CVE-2026-12744.md): A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execu (CVSS 9.8, Ivanti Neurons for ITSM)
- [CVE-2026-18851](https://cve.now/CVE-2026-18851.md): Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attac (CVSS 8.8, Ivanti Endpoint Manager Mobile)
- [CVE-2026-18129](https://cve.now/CVE-2026-18129.md): Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticat (CVSS 8.1, Ivanti Endpoint Manager)
- [CVE-2026-18127](https://cve.now/CVE-2026-18127.md): External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full wr (CVSS 7.7, Ivanti Endpoint Manager)
- [CVE-2026-18125](https://cve.now/CVE-2026-18125.md): An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an a (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2026-14903](https://cve.now/CVE-2026-14903.md): Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web r (CVSS 7.7, ivanti Xtraction)
- [CVE-2026-14902](https://cve.now/CVE-2026-14902.md): An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary externa (CVSS 4.0, ivanti Xtraction)
- [CVE-2026-10727](https://cve.now/CVE-2026-10727.md): An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2026-10523](https://cve.now/CVE-2026-10523.md): An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthent (CVSS 9.9, ivanti Sentry)
- [CVE-2026-10520](https://cve.now/CVE-2026-10520.md): An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user (CVSS 10.0, KEV, ivanti Sentry)
- [CVE-2026-9614](https://cve.now/CVE-2026-9614.md): An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain a (CVSS 8.8, Ivanti Neurons for ITSM)
- [CVE-2026-8992](https://cve.now/CVE-2026-8992.md): An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to ex (CVSS 8.8, ivanti Secure Access Client)
- [CVE-2026-8111](https://cve.now/CVE-2026-8111.md): SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote (CVSS 8.8, ivanti Endpoint Manager)
- [CVE-2026-8110](https://cve.now/CVE-2026-8110.md): Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to es (CVSS 7.8, ivanti Endpoint Manager)
- [CVE-2026-8109](https://cve.now/CVE-2026-8109.md): An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to (CVSS 6.5, ivanti Endpoint Manager)
- [CVE-2026-8051](https://cve.now/CVE-2026-8051.md): OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to (CVSS 7.2, ivanti Virtual Traffic Manager)
- [CVE-2026-7432](https://cve.now/CVE-2026-7432.md): A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM (CVSS 7.8, ivanti Secure Access Client)
- [CVE-2026-7431](https://cve.now/CVE-2026-7431.md): An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to (CVSS 4.4, ivanti Secure Access Client)
- [CVE-2026-8043](https://cve.now/CVE-2026-8043.md): External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and (CVSS 9.6, ivanti Xtraction)
- [CVE-2026-5787](https://cve.now/CVE-2026-5787.md): An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker (CVSS 8.9, Ivanti Endpoint Manager Mobile)
- [CVE-2026-5788](https://cve.now/CVE-2026-5788.md): An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invok (CVSS 7.0, Ivanti Endpoint Manager Mobile)
- [CVE-2026-7821](https://cve.now/CVE-2026-7821.md): Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to (CVSS 7.4, Ivanti Endpoint Manager Mobile)
- [CVE-2026-6973](https://cve.now/CVE-2026-6973.md): An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with admin (CVSS 7.2, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2026-5786](https://cve.now/CVE-2026-5786.md): An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attac (CVSS 8.8, Ivanti Endpoint Manager Mobile)
- [CVE-2026-4914](https://cve.now/CVE-2026-4914.md): Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessi (CVSS 5.4, Ivanti Neurons for ITSM)
- [CVE-2026-4913](https://cve.now/CVE-2026-4913.md): Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when (CVSS 5.7, Ivanti Neurons for ITSM)
- [CVE-2026-3483](https://cve.now/CVE-2026-3483.md): An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges. (CVSS 7.8, Ivanti Desktop and Server Management)
- [CVE-2026-1603](https://cve.now/CVE-2026-1603.md): An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored (CVSS 8.6, KEV, Ivanti Endpoint Manager)
- [CVE-2026-1602](https://cve.now/CVE-2026-1602.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2026-1340](https://cve.now/CVE-2026-1340.md): A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. (CVSS 9.8, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2026-1281](https://cve.now/CVE-2026-1281.md): A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. (CVSS 9.8, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2025-13662](https://cve.now/CVE-2025-13662.md): Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2025-13661](https://cve.now/CVE-2025-13661.md): Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outs (CVSS 7.1, Ivanti Endpoint Manager)
- [CVE-2025-13659](https://cve.now/CVE-2025-13659.md): Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthentic (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-10573](https://cve.now/CVE-2025-10573.md): Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript (CVSS 9.6, Ivanti Endpoint Manager)
- [CVE-2025-10918](https://cve.now/CVE-2025-10918.md): Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write (CVSS 7.1, Ivanti Endpoint Manager)
- [CVE-2025-10986](https://cve.now/CVE-2025-10986.md): Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with (CVSS 4.7, Ivanti Endpoint Manager Mobile)
- [CVE-2025-10985](https://cve.now/CVE-2025-10985.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-10243](https://cve.now/CVE-2025-10243.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-10242](https://cve.now/CVE-2025-10242.md): OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacke (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-62384](https://cve.now/CVE-2025-62384.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62386](https://cve.now/CVE-2025-62386.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62383](https://cve.now/CVE-2025-62383.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62391](https://cve.now/CVE-2025-62391.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62385](https://cve.now/CVE-2025-62385.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62387](https://cve.now/CVE-2025-62387.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62388](https://cve.now/CVE-2025-62388.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62389](https://cve.now/CVE-2025-62389.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62390](https://cve.now/CVE-2025-62390.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-62392](https://cve.now/CVE-2025-62392.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-11623](https://cve.now/CVE-2025-11623.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data (CVSS 6.5, Ivanti Endpoint Manager)
- [CVE-2025-9713](https://cve.now/CVE-2025-9713.md): Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-11622](https://cve.now/CVE-2025-11622.md): Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileg (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2025-55144](https://cve.now/CVE-2025-55144.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 5.4, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55143](https://cve.now/CVE-2025-55143.md): Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55142](https://cve.now/CVE-2025-55142.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55141](https://cve.now/CVE-2025-55141.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55139](https://cve.now/CVE-2025-55139.md): SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 6.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55148](https://cve.now/CVE-2025-55148.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 7.6, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55147](https://cve.now/CVE-2025-55147.md): CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55146](https://cve.now/CVE-2025-55146.md): An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-55145](https://cve.now/CVE-2025-55145.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. (CVSS 8.9, Ivanti Connect Secure 22.7R2.9 · Ivanti Policy Secure +2)
- [CVE-2025-8711](https://cve.now/CVE-2025-8711.md): CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva (CVSS 5.4, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-8712](https://cve.now/CVE-2025-8712.md): Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22 (CVSS 5.4, Ivanti Connect Secure before · Ivanti Policy Secure +2)
- [CVE-2025-9872](https://cve.now/CVE-2025-9872.md): Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-9712](https://cve.now/CVE-2025-9712.md): Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2025-5468](https://cve.now/CVE-2025-5468.md): Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti (CVSS 5.5, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-5466](https://cve.now/CVE-2025-5466.md): XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Iva (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-5462](https://cve.now/CVE-2025-5462.md): A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway be (CVSS 7.5, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-5456](https://cve.now/CVE-2025-5456.md): A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gatewa (CVSS 7.5, Ivanti Connect Secure · Ivanti Policy Secure +2)
- [CVE-2025-8310](https://cve.now/CVE-2025-8310.md): Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticat (CVSS 6.5, Ivanti Virtual Application Delivery ControllerCWE-862)
- [CVE-2025-8297](https://cve.now/CVE-2025-8297.md): Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin priv (CVSS 7.2, Ivanti Avalanche)
- [CVE-2025-8296](https://cve.now/CVE-2025-8296.md): SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrar (CVSS 7.2, Ivanti Avalanche)
- [CVE-2023-39339](https://cve.now/CVE-2023-39339.md): A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fi (CVSS 4.9, Ivanti Policy Secure)
- [CVE-2023-39338](https://cve.now/CVE-2023-39338.md): Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sen (CVSS 6.8, Ivanti Sentry)
- [CVE-2024-38648](https://cve.now/CVE-2024-38648.md): A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including u (CVSS 9.0, Ivanti DSM)
- [CVE-2023-38036](https://cve.now/CVE-2023-38036.md): A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overf (CVSS 9.8, Ivanti Avalanche)
- [CVE-2025-6771](https://cve.now/CVE-2025-6771.md): OS command injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-0292](https://cve.now/CVE-2025-0292.md): SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacke (CVSS 5.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-0293](https://cve.now/CVE-2025-0293.md): CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticat (CVSS 6.6, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-5464](https://cve.now/CVE-2025-5464.md): Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to (CVSS 6.5, Ivanti Connect Secure)
- [CVE-2025-6770](https://cve.now/CVE-2025-6770.md): OS command injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager Mobile)
- [CVE-2025-5463](https://cve.now/CVE-2025-5463.md): Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version (CVSS 5.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-5451](https://cve.now/CVE-2025-5451.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a rem (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-5450](https://cve.now/CVE-2025-5450.md): Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure be (CVSS 6.3, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-7037](https://cve.now/CVE-2025-7037.md): SQL injection in Ivanti Endpoint Manager (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2025-6996](https://cve.now/CVE-2025-6996.md): Improper Encryption in Ivanti Endpoint Manager (CVSS 8.4, Ivanti Endpoint Manager)
- [CVE-2025-6995](https://cve.now/CVE-2025-6995.md): Improper Encryption in Ivanti Endpoint Manager (CVSS 8.4, Ivanti Endpoint Manager)
- [CVE-2025-5353](https://cve.now/CVE-2025-5353.md): A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credential (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2025-22463](https://cve.now/CVE-2025-22463.md): A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environmen (CVSS 7.3, Ivanti Workspace Control)
- [CVE-2025-22455](https://cve.now/CVE-2025-22455.md): A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2025-4428](https://cve.now/CVE-2025-4428.md): Remote Code Execution (CVSS 7.2, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2025-4427](https://cve.now/CVE-2025-4427.md): Authentication Bypass (CVSS 5.3, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2025-22462](https://cve.now/CVE-2025-22462.md): An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows (CVSS 9.8, Ivanti Neurons for ITSM)
- [CVE-2025-22460](https://cve.now/CVE-2025-22460.md): Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privil (CVSS 7.8, Ivanti CSA)
- [CVE-2025-43716](https://cve.now/CVE-2025-43716.md): A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. (CVSS 5.8, Ivanti LANDesk Management Suite)
- [CVE-2025-22466](https://cve.now/CVE-2025-22466.md): Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obta (CVSS 8.2, Ivanti Endpoint Manager)
- [CVE-2025-22465](https://cve.now/CVE-2025-22465.md): Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to exec (CVSS 6.1, Ivanti Endpoint Manager)
- [CVE-2025-22464](https://cve.now/CVE-2025-22464.md): An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attac (CVSS 6.1, Ivanti Endpoint Manager)
- [CVE-2025-22461](https://cve.now/CVE-2025-22461.md): SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admi (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2025-22459](https://cve.now/CVE-2025-22459.md): Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticate (CVSS 4.8, Ivanti Endpoint Manager)
- [CVE-2025-22458](https://cve.now/CVE-2025-22458.md): DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2025-22457](https://cve.now/CVE-2025-22457.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA (CVSS 9.0, KEV, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2025-22454](https://cve.now/CVE-2025-22454.md): Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-38657](https://cve.now/CVE-2024-38657.md): External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-13813](https://cve.now/CVE-2024-13813.md): Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary file (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-13843](https://cve.now/CVE-2024-13843.md): Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a (CVSS 6.0, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-13842](https://cve.now/CVE-2024-13842.md): A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticat (CVSS 6.0, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-13830](https://cve.now/CVE-2024-13830.md): Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthentica (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-12058](https://cve.now/CVE-2024-12058.md): External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a r (CVSS 6.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-10644](https://cve.now/CVE-2024-10644.md): Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticat (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2025-22467](https://cve.now/CVE-2025-22467.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code (CVSS 9.9, Ivanti Connect Secure)
- [CVE-2024-11771](https://cve.now/CVE-2024-11771.md): Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. (CVSS 5.3, Ivanti Cloud Services Application)
- [CVE-2024-47908](https://cve.now/CVE-2024-47908.md): OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilege (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2024-13162](https://cve.now/CVE-2024-13162.md): SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authentic (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-13163](https://cve.now/CVE-2024-13163.md): Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-13164](https://cve.now/CVE-2024-13164.md): An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a loca (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-13165](https://cve.now/CVE-2024-13165.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2024-13166](https://cve.now/CVE-2024-13166.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2024-13167](https://cve.now/CVE-2024-13167.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2024-13168](https://cve.now/CVE-2024-13168.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2024-13169](https://cve.now/CVE-2024-13169.md): An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local au (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-13170](https://cve.now/CVE-2024-13170.md): An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2024-13171](https://cve.now/CVE-2024-13171.md): Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-13172](https://cve.now/CVE-2024-13172.md): Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-13158](https://cve.now/CVE-2024-13158.md): An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allow (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-13159](https://cve.now/CVE-2024-13159.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager)
- [CVE-2024-13160](https://cve.now/CVE-2024-13160.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager)
- [CVE-2024-13161](https://cve.now/CVE-2024-13161.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, KEV, Ivanti Endpoint Manager)
- [CVE-2024-10811](https://cve.now/CVE-2024-10811.md): Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote (CVSS 9.8, Ivanti Endpoint Manager)
- [CVE-2024-13181](https://cve.now/CVE-2024-13181.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. (CVSS 7.3, Ivanti Avalanche)
- [CVE-2024-13180](https://cve.now/CVE-2024-13180.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-13179](https://cve.now/CVE-2024-13179.md): Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. (CVSS 7.3, Ivanti Avalanche)
- [CVE-2024-10630](https://cve.now/CVE-2024-10630.md): A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the applicati (CVSS 7.8, Ivanti Application Control Engine)
- [CVE-2025-0283](https://cve.now/CVE-2025-0283.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu (CVSS 7.0, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2025-0282](https://cve.now/CVE-2025-0282.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu (CVSS 9.0, KEV, Ivanti Connect Secure · Ivanti Policy Secure +1)
- [CVE-2024-37401](https://cve.now/CVE-2024-37401.md): An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial o (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-37377](https://cve.now/CVE-2024-37377.md): A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a d (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-11598](https://cve.now/CVE-2024-11598.md): Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows (CVSS 7.8, Ivanti Application Control)
- [CVE-2024-11597](https://cve.now/CVE-2024-11597.md): Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows (CVSS 7.8, Ivanti Performance Manager)
- [CVE-2024-8496](https://cve.now/CVE-2024-8496.md): Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attack (CVSS 7.8, Ivanti Workspace Control)
- [CVE-2024-9845](https://cve.now/CVE-2024-9845.md): Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to a (CVSS 7.8, Ivanti Automation)
- [CVE-2024-10251](https://cve.now/CVE-2024-10251.md): Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker (CVSS 7.8, Ivanti Security Controls)
- [CVE-2024-11773](https://cve.now/CVE-2024-11773.md): SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ru (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2024-11772](https://cve.now/CVE-2024-11772.md): Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges t (CVSS 9.1, Ivanti Cloud Services Application)
- [CVE-2024-11639](https://cve.now/CVE-2024-11639.md): An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative (CVSS 10.0, Ivanti Cloud Services Application)
- [CVE-2024-7572](https://cve.now/CVE-2024-7572.md): Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. (CVSS 7.1, Ivanti Desktop and Server Management)
- [CVE-2024-8540](https://cve.now/CVE-2024-8540.md): Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive a (CVSS 8.8, Ivanti Sentry)
- [CVE-2024-11634](https://cve.now/CVE-2024-11634.md): Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenti (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11633](https://cve.now/CVE-2024-11633.md): Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve (CVSS 9.1, Ivanti Connect Secure)
- [CVE-2024-9844](https://cve.now/CVE-2024-9844.md): Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticat (CVSS 7.1, Ivanti Connect Secure)
- [CVE-2024-10256](https://cve.now/CVE-2024-10256.md): Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. (CVSS 7.1, Ivanti Patch SDK · Ivanti Endpoint Manager +4)
- [CVE-2024-38655](https://cve.now/CVE-2024-38655.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18 (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-34784](https://cve.now/CVE-2024-34784.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34780](https://cve.now/CVE-2024-34780.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-29211](https://cve.now/CVE-2024-29211.md): A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratio (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-39712](https://cve.now/CVE-2024-39712.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-34781](https://cve.now/CVE-2024-34781.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-37400](https://cve.now/CVE-2024-37400.md): An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-32839](https://cve.now/CVE-2024-32839.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-38654](https://cve.now/CVE-2024-38654.md): Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to (CVSS 4.4, Ivanti Secure Access Client)
- [CVE-2024-38649](https://cve.now/CVE-2024-38649.md): An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-39711](https://cve.now/CVE-2024-39711.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-39709](https://cve.now/CVE-2024-39709.md): Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version (CVSS 7.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-38656](https://cve.now/CVE-2024-38656.md): Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-32844](https://cve.now/CVE-2024-32844.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34787](https://cve.now/CVE-2024-34787.md): Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent (CVSS 7.8, Ivanti EPM)
- [CVE-2024-32847](https://cve.now/CVE-2024-32847.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-37398](https://cve.now/CVE-2024-37398.md): Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-32841](https://cve.now/CVE-2024-32841.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34782](https://cve.now/CVE-2024-34782.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-39710](https://cve.now/CVE-2024-39710.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-37376](https://cve.now/CVE-2024-37376.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-7571](https://cve.now/CVE-2024-7571.md): Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-9843](https://cve.now/CVE-2024-9843.md): A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. (CVSS 5.0, Ivanti Secure Access Client)
- [CVE-2024-9842](https://cve.now/CVE-2024-9842.md): Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders (CVSS 7.3, Ivanti Secure Access Client)
- [CVE-2024-8539](https://cve.now/CVE-2024-8539.md): Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive config (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-11004](https://cve.now/CVE-2024-11004.md): Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthentica (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11005](https://cve.now/CVE-2024-11005.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11006](https://cve.now/CVE-2024-11006.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11007](https://cve.now/CVE-2024-11007.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-8495](https://cve.now/CVE-2024-8495.md): A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote (CVSS 7.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-47909](https://cve.now/CVE-2024-47909.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a rem (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-47907](https://cve.now/CVE-2024-47907.md): A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a (CVSS 7.5, Ivanti Connect Secure)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/ivanti
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.