CVE Intelligence

Ivanti vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Ivanti products: 110 record(s), with severity, exploitation and fixes.

Endpoint Manager 30Connect Secure 27Policy Secure 19Endpoint Manager Mobile 18Zero Trust Access Gateway 12Neurons For Secure Access 11ZTA Gateway 11Neurons For Itsm 8Xtraction 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4ICS 3Neurons for ITSM (Cloud) 3Secure Access Client 3IPS 3Sentry 3EPMM 2Virtual Traffic Manager 2Standalone Sentry 2Neurons for ITSM (On-Premise) 2Neurons For Zero-trust Access 2Neurons for ZTA gateways 2Connect Secure before 1Connect Secure 22.7R2.9 1Neurons for Secure 1Desktop and Server Management 1Neurons for ITSM (On-Premises) 1Neurons Patch for Intune 1Desktop & Server Management 1MobileIron Sentry 1Cloud Services Appliance 1vTM 1EPM 1

Exploited only (KEV) →

CVE-2021-44529 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Dec 8, 2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2021-22899 High · 8.8 KEV High · 56 CWE-77 May 27, 2021
Ivanti Pulse Connect Secure Command Injection Vulnerability
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
CVE-2021-22894 High · 8.8 KEV High · 56 CWE-119 May 27, 2021
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
CVE-2021-22900 High · 7.2 KEV High · 55 CWE-669 May 27, 2021
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CVE-2021-22893 Critical · 10.0 KEV Urgent · 79 Public exploit Ransomware CWE-416 Apr 23, 2021
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2020-8260 High · 7.2 KEV High · 68 Public exploit CWE-434 Oct 28, 2020
Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
CVE-2020-8243 High · 7.2 KEV High · 56 CWE-94 Sep 30, 2020
Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVE-2020-8218 High · 7.2 KEV High · 62 Public exploit CWE-94 Jul 30, 2020
Pulse Connect Secure Code Injection Vulnerability
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2019-11510 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-22 May 8, 2019
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
CVE-2019-11539 High · 7.2 KEV Urgent · 86 Public exploit Ransomware CWE-78 Apr 25, 2019
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.