Ivanti vulnerabilities
413 CVEs and advisories name Ivanti as an affected vendor, 28 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-21894A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated mal
- CVE-2024-22053A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated mal
- CVE-2024-22052A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthen
- CVE-2024-22023An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unaut
- CVE-2023-46808An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server.
- CVE-2023-41724A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the
- CVE-2024-22024An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and
- CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)
- CVE-2024-21888A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a use
- CVE-2024-21887A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an aut
- CVE-2023-46805An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc
- CVE-2023-39336An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the int
- CVE-2023-46220An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46261An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46266An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- CVE-2023-46260An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46258An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46803An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46264An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t
- CVE-2023-46262An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R
- CVE-2023-46224An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46221An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46216An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46222An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-41727An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46217An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46265An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
- CVE-2023-46257An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46804An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46263An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t