CVE Intelligence

Vulnerabilidades de Ivanti

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Ivanti: 99 registro(s), com severidade, exploração e correções.

Endpoint Manager 30Endpoint Manager Mobile 18Connect Secure 16Neurons For Itsm 8Xtraction 8Policy Secure 8Endpoint Manager Cloud Services Appliance 4CSA (Cloud Services Appliance) 4Sentry 3Neurons for ITSM (Cloud) 3Secure Access Client 3ICS 3IPS 3Neurons for ZTA gateways 2Neurons for ITSM (On-Premise) 2Standalone Sentry 2Virtual Traffic Manager 2EPMM 2Neurons For Zero-trust Access 2MobileIron Sentry 1Desktop & Server Management 1Cloud Services Appliance 1vTM 1EPM 1Neurons Patch for Intune 1Neurons for ITSM (On-Premises) 1Desktop and Server Management 1Zero Trust Access Gateway 1

Somente exploradas (KEV) →

CVE-2025-0282 Crítica · 9.0 KEV Urgente · 88 Exploit público Ransomware CWE-787 08/01/2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-9379 Alta · 7.2 KEV Alta · 56 CWE-89 08/10/2024
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVE-2024-9380 Alta · 7.2 KEV Alta · 56 CWE-78 08/10/2024
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
CVE-2024-8963 Crítica · 9.1 KEV Urgente · 73 Exploit público CWE-22 19/09/2024
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
CVE-2024-8190 Alta · 7.2 KEV Alta · 62 Exploit público CWE-78 10/09/2024
Ivanti Cloud Services Appliance OS Command Injection Vulnerability
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
CVE-2024-7593 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-287 13/08/2024
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVE-2024-29824 Alta · 8.8 KEV Urgente · 79 Exploit público CWE-89 31/05/2024
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVE-2024-21893 Alta · 8.2 KEV Urgente · 89 Exploit público Ransomware CWE-918 31/01/2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2024-21887 Crítica · 9.1 KEV Urgente · 90 Exploit público Ransomware CWE-77 12/01/2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805 Alta · 8.2 KEV Urgente · 99 Exploit público Ransomware CWE-287 12/01/2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-38035 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-863 21/08/2023
Ivanti Sentry Authentication Bypass Vulnerability
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-35082 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-287 15/08/2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2023-35081 Alta · 7.2 KEV Alta · 56 CWE-22 03/08/2023
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
CVE-2023-35078 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-287 25/07/2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2021-44529 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 08/12/2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2021-22899 Alta · 8.8 KEV Alta · 56 CWE-77 27/05/2021
Ivanti Pulse Connect Secure Command Injection Vulnerability
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
CVE-2021-22894 Alta · 8.8 KEV Alta · 56 CWE-119 27/05/2021
Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
CVE-2021-22900 Alta · 7.2 KEV Alta · 55 CWE-669 27/05/2021
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CVE-2021-22893 Crítica · 10.0 KEV Urgente · 79 Exploit público Ransomware CWE-416 23/04/2021
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVE-2020-8260 Alta · 7.2 KEV Alta · 68 Exploit público CWE-434 28/10/2020
Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
CVE-2020-8243 Alta · 7.2 KEV Alta · 56 CWE-94 30/09/2020
Ivanti Pulse Connect Secure Code Execution Vulnerability
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVE-2020-8218 Alta · 7.2 KEV Alta · 62 Exploit público CWE-94 30/07/2020
Pulse Connect Secure Code Injection Vulnerability
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2019-11510 Crítica · 10.0 KEV Urgente · 100 Exploit público Ransomware CWE-22 08/05/2019
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
CVE-2019-11539 Alta · 7.2 KEV Urgente · 86 Exploit público Ransomware CWE-78 25/04/2019
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.