573 matches found
CVE-2024-32848
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-34779
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-37397
CVE-2024-37397 is an XXE vulnerability in Ivanti Endpoint Manager (EPM) provisioning web service. It affects EPM 2022 SU5 and earlier, and 2024.s September update/pre-release lines, allowing a remote unauthenticated attacker to leak API secrets. The issue stems from external XML entity handling i...
CVE-2024-29847
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...
CVE-2024-32848
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-32842
CVE-2024-32842 is an unspecified SQL injection in Ivanti Endpoint Manager (EPM) that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Technical context across connected sources indicates the vulnerability affects EPM versions prior to the 2022 SU6 ...
CVE-2024-32840
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-32848
CVE-2024-32848 is an SQL injection in Ivanti Endpoint Manager (EPM) affecting versions prior to the 2024 September update and prior to 2022 SU6 in some advisories. The flaw is exploitable by a remote authenticated attacker with admin privileges to achieve remote code execution. Red Hat and NVD en...
CVE-2024-32845
Ivanti Endpoint Manager (EPM) is affected by an unspecified SQL injection vulnerability (CVE-2024-32845) that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Technical details across connected sources confirm impact on EPM 2022 SU6 and 2024 Septem...
CVE-2024-34779
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-32843
CVE-2024-32843 affects Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier, and 2024-era installations before the September 2024 update. The vulnerability is an unspecified SQL injection in Ivanti EPM that, when combined with a remote authenticated admin, enables remote code execution. Evidence fr...
CVE-2024-29847
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...
CVE-2024-34779
Ivanti Endpoint Manager (EPM) has multiple CVEs for unspecified SQL injection vulnerabilities that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. CVE-2024-34779 is among these issues; related entries (CVE-2024-32840, -32842, -32843, -32845, -3284...
CVE-2024-29847
CVE-2024-29847 is a deserialization-of-untrusted-data vulnerability in Ivanti Endpoint Manager (AgentPortal) that enables remote code execution on Ivanti EPM installations running pre-2022 SU6 or the 2024 September update. Public materials in connected docs confirm remote, unauthenticated RCE wit...
CVE-2024-32846
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-32845
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-34783
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-34783
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...
CVE-2024-32840
CVE-2024-32840 affects Ivanti Endpoint Manager (EPM). The reported issue is an unspecified SQL injection in EPM before the 2024 September update (or the 2024 September update) that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public documents from...