Ivanti vulnerabilities
413 CVEs and advisories name Ivanti as an affected vendor, 28 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-46225An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46259An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2023-46223An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of
- CVE-2021-22962An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- CVE-2023-39340A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to
- CVE-2023-41719A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a sp
- CVE-2023-41720A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (
- CVE-2023-39337A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier t
- CVE-2023-41718When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when ha
- CVE-2023-39335A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to imp
- CVE-2023-35080A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi
- CVE-2023-38544A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings.
- CVE-2023-38043A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker
- CVE-2023-38543A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker
- CVE-2023-41726Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability
- CVE-2023-41725Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability
- CVE-2022-43554Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability
- CVE-2022-43555Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability
- CVE-2022-44569A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.
- CVE-2023-38041A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.
- CVE-2023-35083Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all pre
- CVE-2023-35084Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous
- CVE-2023-38035A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou
- CVE-2023-28129DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatio
- CVE-2023-32560An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co
- CVE-2023-32561A previously generated artifact by an administrator could be accessed by an attacker.
- CVE-2023-32562An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t
- CVE-2023-32563An unauthenticated attacker could achieve the code execution through a RemoteControl server.
- CVE-2023-32564An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t