Filtered by vendor Ivanti Subscriptions
Total 323 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-35081 1 Ivanti 1 Endpoint Manager Mobile 2024-12-20 7.2 High
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
CVE-2023-38035 1 Ivanti 1 Mobileiron Sentry 2024-12-20 9.8 Critical
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-35078 1 Ivanti 1 Endpoint Manager Mobile 2024-12-20 9.8 Critical
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2024-10251 1 Ivanti 1 Security Controls 2024-12-20 7.8 High
Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation.
CVE-2024-9845 1 Ivanti 1 Automation 2024-12-19 7.8 High
Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation.
CVE-2024-50331 1 Ivanti 1 Avalanche 2024-12-18 7.5 High
An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory.
CVE-2024-7612 1 Ivanti 1 Endpoint Manager Mobile 2024-12-18 8.8 High
Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.
CVE-2024-8496 1 Ivanti 1 Workspace Control 2024-12-14 7.8 High
Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.
CVE-2024-39712 1 Ivanti 2 Connect Secure, Policy Secure 2024-12-01 N/A
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-39711 1 Ivanti 2 Connect Secure, Policy Secure 2024-12-01 N/A
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-39710 1 Ivanti 2 Connect Secure, Policy Secure 2024-12-01 N/A
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-38656 1 Ivanti 2 Automation, Connect Secure 2024-12-01 9.1 Critical
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-29824 1 Ivanti 1 Endpoint Manager 2024-11-29 8.8 High
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVE-2024-21887 1 Ivanti 2 Connect Secure, Policy Secure 2024-11-29 9.1 Critical
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2024-21893 1 Ivanti 3 Connect Secure, Neurons For Zero-trust Access, Policy Secure 2024-11-29 8.2 High
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-9420 1 Ivanti 2 Connect Secure, Policy Secure 2024-11-28 8.8 High
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 and 9.1R18.9 allows a remote authenticated attacker to achieve remote code execution
CVE-2023-39340 1 Ivanti 1 Connect Secure 2024-11-27 7.5 High
A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the appliance.
CVE-2023-46260 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-27 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46217 2 Ivanti, Microsoft 2 Avalanche, Windows 2024-11-27 9.8 Critical
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2024-8190 1 Ivanti 1 Cloud Services Appliance 2024-11-26 7.2 High
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.