Vulnerabilities in Ivanti
400 resultsCVE-2024-22024HIGHAn XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) andEPSS 94.7%CVE-2024-38653HIGHXXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.EPSS 92.0%CVE-2021-22962HIGHAn attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.EPSS 91.0%CVE-2024-13160CRITICALAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteEPSS 91.0%KEVCVE-2023-46264HIGHAn unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker tEPSS 90.2%CVE-2024-13161CRITICALAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteEPSS 89.8%KEVCVE-2023-32563HIGHAn unauthenticated attacker could achieve the code execution through a RemoteControl server.EPSS 89.1%CVE-2026-104935HIGHAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. ThiEPSS 88.9%KEVCVE-2024-8190HIGHAn OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attEPSS 88.5%KEVCVE-2026-1603HIGHAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedEPSS 88.3%KEVCVE-2025-4428HIGHRemote Code ExecutionEPSS 88.0%KEVCVE-2024-21888HIGHA privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a useEPSS 85.4%CVE-2022-36974CRITICALThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authEPSS 84.5%CVE-2022-36981HIGHThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although autheEPSS 83.4%CVE-2023-46262HIGHAn unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche REPSS 82.8%CVE-2022-36980CRITICALThis vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although autheEPSS 82.4%CVE-2023-46263HIGHAn unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker tEPSS 81.9%CVE-2022-36982MEDIUMThis vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentEPSS 73.8%CVE-2024-29827CRITICALAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samEPSS 71.7%CVE-2024-37404CRITICALImproper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1EPSS 71.0%