Filtered by vendor Ivanti Subscriptions
Filtered by product Connect Secure Subscriptions
Total 132 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-55143 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 6.1 Medium
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.
CVE-2025-55142 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-8712 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 5.4 Medium
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVE-2025-55141 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-55139 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 6.8 Medium
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.
CVE-2025-5456 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-23 7.5 High
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125
CVE-2025-5462 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-23 7.5 High
A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.
CVE-2025-5466 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-23 4.9 Medium
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service
CVE-2025-5468 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-23 5.5 Medium
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.
CVE-2024-37404 1 Ivanti 2 Connect Secure, Policy Secure 2025-09-23 8.8 High
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
CVE-2024-12058 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-16 6.8 Medium
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files.
CVE-2024-39709 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-16 7.8 High
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.
CVE-2024-38649 1 Ivanti 1 Connect Secure 2025-07-16 7.5 High
An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.
CVE-2025-5450 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-15 6.3 Medium
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.
CVE-2025-5451 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-15 4.9 Medium
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service.
CVE-2025-5463 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-15 5.5 Medium
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information.
CVE-2025-0292 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-15 5.5 Medium
SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services.
CVE-2025-5464 1 Ivanti 1 Connect Secure 2025-07-15 6.5 Medium
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information.
CVE-2024-10644 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-14 9.1 Critical
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-0293 1 Ivanti 2 Connect Secure, Policy Secure 2025-07-14 6.6 Medium
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.