CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

CVE-2025-13659

Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required...

CVE-2025-13659

Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required...

CVE-2025-13659

CVE-2025-13659 concerns Ivanti Endpoint Manager. Affected: Ivanti Endpoint Manager prior to 2024 SU4 SR1. Root cause: improper control of dynamically managed code resources. Impact: remote unauthenticated attacker can write arbitrary files on the server, potentially enabling remote code execution...

CVE-2025-10573

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required...

CVE-2025-10573

Ivanti Endpoint Manager is affected by CVE-2025-10573 (Stored XSS) in versions before 2024 SU4 SR1. The vulnerability allows an unauthenticated attacker to inject JavaScript in the administrator session via crafted device scan data, requiring user interaction to trigger the payload. Several conne...

CVE-2025-10573

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required...

CVE-2025-10573: Ivanti EPM Unauthenticated Stored Cross-Site Scripting (Fixed)

Ivanti Endpoint Manager “EPM” versions 2024 SU4 and below are vulnerable to stored cross-site scripting “XSS”. The vulnerability, tracked as CVE-2025-10573 and assigned a CVSS score of 9.6, was patched on December 9, 2025 with the release of Ivanti EPM version EPM 2024 SU4 SR1. An attacker with...

PT-2025-50274

Name of the Vulnerable Software and Affected Versions FreePBX Endpoint Manager versions 16.0.0 through 16.0.43 FreePBX Endpoint Manager versions 17.0.0 through 17.0.22 Description The FreePBX Endpoint Manager module contains a flaw in its authentication mechanism when the authentication type is s...

Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager EPM versions prior to 2024 SU4 SR1, which stems from improper control of dynamically managed code resources and could lead to remote code...

Ivanti Endpoint Manager 路径遍历漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti USA. A path traversal vulnerability exists in Ivanti Endpoint Manager EPM versions prior to 2024 SU4 SR1, which stems from path traversal and could lead to arbitrary file writes...

Ivanti Endpoint Manager 数据伪造问题漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti USA. A data forgery issue vulnerability exists in versions prior to Ivanti Endpoint Manager 2024 SU4 SR1 that stems from improper cryptographic signature validation and could lead to remote code execution...

PT-2025-50087

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 Description A path traversal issue exists in Ivanti Endpoint Manager. A remote authenticated attacker can write arbitrary files to locations outside the intended directory. User interactio...

PT-2025-50088

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 Description A flaw exists in the patch management component of Ivanti Endpoint Manager that involves improper verification of cryptographic signatures. This allows a remote, unauthenticate...

Ivanti Endpoint Manager 跨站脚本漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A cross-site scripting vulnerability exists in Ivanti Endpoint Manager EPM versions prior to 2024 SU4 SR1, which originates from stored cross-site scripting and could lead to a remote, unauthenticat...

PT-2025-50086

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 Description A flaw exists in Ivanti Endpoint Manager due to improper control of dynamically managed code resources. A remote, unauthenticated attacker can write arbitrary files on the...

FreePBX Endpoint Manager 授权问题漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from the FreePBX open source. An authorization issue vulnerability exists in FreePBX Endpoint Manager that stems from an authentication bypass that could lead to unauthorized access...

Security Advisory EPM December 2025 for EPM 2024

Summary: Ivanti has released an update for Ivanti Endpoint Manager EPM which addresses three high severity vulnerabilities and one critical severity vulnerability in the EPM core and remote consoles. We are not aware of any customers being exploited by these vulnerabilities at the time of...

PT-2025-50085

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions 2024 SU4 and below Description Ivanti Endpoint Manager contains a critical stored cross-site scripting XSS flaw that allows a remote, unauthenticated attacker to execute arbitrary JavaScript code in the context...

Motex LanScope Endpoint Manager Remote Code Execution (CVE-2025-61932)

Lanscope Endpoint Manager On-Premises Client program MR and Detection agent DA improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. Note that Nessus has not tested for this issue but has instead relied only on th...