CVE-2025-22466

Ivanti Endpoint Manager is affected by CVE-2025-22466 (Reflected XSS) in versions prior to 2024 SU1 and prior to 2022 SU7. An unauthenticated remote attacker can obtain admin privileges, with user interaction required. Connected sources also indicate remediation: Ivanti has released updates addre...

CVE-2025-22465

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required...

CVE-2025-22465

Ivanti Endpoint Manager is affected by CVE-2025-22465 (Reflected XSS) in versions older than 2024 SU1 or older than 2022 SU7. An unauthenticated remote attacker can cause the victim’s browser to execute arbitrary JavaScript. The issue arises from insufficient input handling in the web interface. ...

CVE-2025-22465

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required...

CVE-2025-22464

CVE-2025-22464 affects Ivanti Endpoint Manager prior to 2024 SU1 or prior to 2022 SU7. The issue is an untrusted pointer dereference that allows a locally authenticated attacker to write arbitrary data into memory, causing a denial-of-service. Remediation per sources: upgrade to Ivanti Endpoint M...

CVE-2025-22464

An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition...

CVE-2025-22464

An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition...

CVE-2025-22461

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution...

CVE-2025-22461

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution...

CVE-2025-22461

CVE-2025-22461 is a SQL injection vulnerability in Ivanti Endpoint Manager affecting versions prior to 2024 SU1 and prior to 2022 SU7. The vulnerability could allow a remote authenticated attacker with admin privileges to achieve code execution. Public sources (Ivanti advisory and vendor/NVD list...

CVE-2025-22459

Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers...

CVE-2025-22459

Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers...

CVE-2025-22459

CVE-2025-22459 describes an improper certificate validation issue in Ivanti Endpoint Manager , affecting versions prior to 2024 SU1 and prior to 2022 SU7 . An unauthenticated remote attacker could intercept limited traffic between clients and servers due to this certificate validation flaw. Docum...

CVE-2025-22458

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System...

CVE-2025-22458

DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System...

CVE-2025-22458

Ivanti Endpoint Manager is affected by DLL hijacking (CVE-2025-22458). The flaw allows an authenticated, local attacker to escalate to SYSTEM by loading a malicious DLL under vulnerable conditions. Affected versions include before 2024 SU1 and before 2022 SU7; fixes are in 2022 SU7/2024 SU1 (and ...

Security Advisory April 2025 for Ivanti EPM 2024 and EPM 2022 SU6

Security Advisory Ivanti EPM 2022 SU6 and EPM 2024 Multiple CVEs Summary Ivanti has released updates for Ivanti Endpoint Manager which addresses medium and high vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability...

PT-2025-15438 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 SU1 Ivanti Endpoint Manager versions prior to 2022 SU7 Description: The issue is related to an untrusted pointer dereference, allowing an attacker with local access to write arbitrary data into...

Ivanti Endpoint Manager SQL注入漏洞

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...

Ivanti Endpoint Manager（EPM） 跨站脚本漏洞

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...