PT-2025-6247 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Ivanti Policy Secure versions prior to 22.7R1.3 Description: A hardcoded key in the software allows a local authenticated attacker with admin privileges to read sensitive data. Recommendations:...

Ivanti Connect Secure和Ivanti Policy Secure 安全漏洞

Ivanti Connect Secure ICS and Ivanti Policy Secure IPS are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. A security vulnerability exists in Ivanti Connect Secure prior to...

PT-2025-6242

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.6 Description A stack-based buffer overflow in Ivanti Connect Secure allows a remote authenticated attacker to achieve remote code execution. The issue is actively exploited. Approximately 3.2...

Ivanti Connect Secure 跨站脚本漏洞

Ivanti Connect Secure ICS is a secure remote network connectivity tool from Ivanti Corporation, USA. A cross-site scripting vulnerability exists in Ivanti Connect Secure prior to version 22.7R2.6 and Ivanti Policy Secure prior to version 22.7R1.3, which stems from the inclusion of a reflective...

Ivanti Connect Secure 安全漏洞

Ivanti Connect Secure ICS is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure prior to version 22.7R2.3 and Ivanti Policy Secure prior to version 22.7R1.3, which stems from the inclusion of a hard-coded key issue...

Ivanti Connect Secure 代码注入漏洞

Ivanti Connect Secure ICS is a secure remote network connectivity tool from Ivanti Corporation, USA. A code injection vulnerability exists in Ivanti Connect Secure prior to version 22.7R2.4 and Ivanti Policy Secure prior to version 22.7R1.3, which stems from the inclusion of a code injection issu...

Ivanti Connect Secure 安全漏洞

Ivanti Connect Secure ICS is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability previously existed in Ivanti Connect Secure version 22.7R2.6, which stemmed from the inclusion of a stack-based buffer overflow issue...

The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure network access control tools arises from the improper assignment of permissions for critical resources. This allows attackers to increase their privileges.

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure network access control tools is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

Metasploit Weekly Wrap-Up 02/07/2025

Gathering data and improving workflows This week's release includes 2 new auxiliary modules targeting Argus Surveillance DVR and Ivanti Connect Secure. The former, contributed by Maxwell Francis, and based on the work of John Page, can be used to retrieve arbitrary files on the target's filesyste...

CVE-2025-0282

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2025-0283

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges...

CVE-2024-21893

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication...

CVE-2024-21888

A privilege escalation vulnerability in web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a user to elevate privileges to that of an administrator...

CVE-2024-21887

A command injection vulnerability in web components of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance...

CVE-2024-21894

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of...

CVE-2024-47907

A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-47906

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.2 Not Applicable to 9.1Rx allows a local authenticated attacker to escalate privileges...

CVE-2024-29205

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions...

CVE-2024-9844

Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions...

CVE-2024-11005

Command injection in Ivanti Connect Secure before version 22.7R2.1 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.1 Not Applicable to 9.1Rx allows a remote authenticated attacker with admin privileges to achieve remote code execution...