Vulnerabilities in ivanti

391 results
Vexday analysis

Ivanti apresenta 12 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando risco emergente e recente. Três são críticas (CVSS alto), mas nenhuma está sob exploração ativa confirmada no momento. A fraqueza dominante é CWE-732 (permissões incorretas), sugerindo problemas de controle de acesso que demandam priorização na correção.

CVE-2021-3198MEDIUMIvanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionEPSS 3.3%CVE-2024-24997HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.2%CVE-2024-24998HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.2%CVE-2024-27976HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.2%CVE-2024-32847HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 3.2%CVE-2024-37376HIGHSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticEPSS 3.2%CVE-2023-28323CRITICALA deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. ThiEPSS 3.1%CVE-2024-37381HIGHAn unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network tEPSS 3.1%CVE-2024-25000HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 3.0%CVE-2024-22023MEDIUMAn XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unautEPSS 3.0%CVE-2026-8051HIGHOS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges toEPSS 3.0%CVE-2024-24999HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 2.9%CVE-2023-35084—Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previousEPSS 2.8%CVE-2024-10644CRITICALCode injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticatEPSS 2.8%CVE-2024-23534HIGHAn Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to executEPSS 2.7%CVE-2024-13170HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.7%CVE-2023-38036CRITICALA security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overfEPSS 2.7%CVE-2024-13165HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%CVE-2024-13168HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%CVE-2024-13167HIGHAn out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote EPSS 2.6%