CVE Intelligence

Vulnerabilidades de Ivanti

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Ivanti: 99 registro(s), com severidade, exploração e correções.

Endpoint Manager 30Endpoint Manager Mobile 18Connect Secure 16Neurons For Itsm 8Xtraction 8Policy Secure 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4Sentry 3Neurons for ITSM (Cloud) 3Secure Access Client 3ICS 3IPS 3Neurons for ZTA gateways 2Neurons for ITSM (On-Premise) 2Standalone Sentry 2Virtual Traffic Manager 2EPMM 2Neurons For Zero-trust Access 2MobileIron Sentry 1Desktop & Server Management 1Cloud Services Appliance 1vTM 1EPM 1Neurons Patch for Intune 1Neurons for ITSM (On-Premises) 1Desktop and Server Management 1Zero Trust Access Gateway 1

Somente exploradas (KEV) →

CVE-2025-10573 Média · 6.1 CWE-79 09/12/2025
Cross-site Scripting (XSS) em Ivanti Endpoint Manager
Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
CVE-2025-10918 Alta · 7.1 CWE-276 11/11/2025
Incorrect Default Permissions em Ivanti Endpoint Manager
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk
CVE-2025-10986 Média · 5.5 CWE-22 14/10/2025
Path Traversal em Ivanti Endpoint Manager Mobile
Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.
CVE-2025-10985 Alta · 7.2 CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10243 Alta · 7.2 CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-10242 Alta · 7.2 CWE-78 14/10/2025
OS Command Injection em Ivanti Endpoint Manager Mobile
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-62392 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62391 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62390 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62389 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62388 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62387 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62386 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62385 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62384 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62383 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-11623 Média · 6.5 CWE-89 13/10/2025
SQL Injection em Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-9713 Alta · 8.8 CWE-22 13/10/2025
Path Traversal em Ivanti Endpoint Manager
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVE-2025-11622 Alta · 7.8 CWE-502 13/10/2025
Deserialization of Untrusted Data em Ivanti Endpoint Manager
Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
CVE-2025-4427 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-288 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
CVE-2025-4428 Alta · 8.8 KEV Urgente · 77 Exploit público CWE-94 13/05/2025
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
CVE-2025-22457 Crítica · 9.8 KEV Urgente · 88 Exploit público Ransomware CWE-787 03/04/2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-13159 Alta · 7.5 KEV Alta · 69 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13160 Alta · 7.5 KEV Alta · 63 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-13161 Alta · 7.5 KEV Alta · 63 Exploit público CWE-36 14/01/2025
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.