CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39709

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1 Not Applicable to 9.1Rx allow a local authenticated attacker to escalate their privileges...

CVE-2024-38656

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-38656

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-38655

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-37400

CVE-2024-37400 is an out-of-bounds read in Ivanti Connect Secure prior to version 22.7R2.3 that allows a remote unauthenticated attacker to trigger an infinite loop, resulting in a denial of service. Public sources in the connected documents confirm affected product/version: Ivanti Connect Secure...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

CVE-2024-39712 describes an argument injection vulnerability in Ivanti Connect Secure prior to 22.7R2.1 and 9.1R18.7, and Ivanti Policy Secure prior to 22.7R1.1, that allows a remote authenticated attacker with administrative privileges to achieve remote code execution via the web interface (note...

CVE-2024-39709

CVE-2024-39709 involves Ivanti Connect Secure and Ivanti Policy Secure where the root cause is incorrect file permissions. A local, authenticated attacker can escalate privileges on affected builds prior to 22.6R2 (Connect Secure) and prior to 22.7R1 (Policy Secure). Connected documents confirm t...

CVE-2024-37400

An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service...

CVE-2024-38649

An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1Not Applicable to 9.1Rx allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-39710

CVE-2024-39710 involves argument injection in Ivanti Connect Secure (pre-22.7R2.1) and Ivanti Policy Secure (pre-22.7R1.1). An authenticated admin can exploit the web interfaces to achieve remote code execution. The issue affects the web-facing components and is reported with a 9.1/CRITICAL CVSS....

CVE-2024-38655

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-38655

CVE-2024-38655 is an argument-injection flaw in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Affected: ICS before 22.7R2.1 (not applicable to 9.1Rx) and IPS before 22.7R1.1 (not appli...

CVE-2024-38649

The CVE-2024-38649 issue is an out-of-bounds write in IPsec of Ivanti Connect Secure older than 22.7R2.1 (not applicable to 9.1Rx) that can be exploited remotely by an unauthenticated attacker to cause a denial of service. Connected advisories confirm this vulnerability affects Ivanti Connect Sec...

Ivanti Connect Secure和Ivanti Policy Secure 参数注入漏洞

Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. A parameter injection vulnerability exists in Ivanti Connect Secure versio...

CVE-2024-39712: Improper Neutralization of Argument Delimiters in a Command

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-38655: Improper Neutralization of Argument Delimiters in a Command

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39709: Incorrect Permission Assignment for Critical Resource

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1 Not Applicable to 9.1Rx allow a local authenticated attacker to escalate their privileges...