Security Advisory Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), Ivanti Secure Access Client (ISAC) (Multiple CVEs)

Summary Ivanti has released updates for Ivanti Connect Secure ICS,Ivanti Policy Secure IPS and Ivanti Secure Access Client ISAC which addresses medium, high and critical vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure...

PT-2024-39055 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: A null pointer dereference allows a remote unauthenticated attacker to cause a denial of service. This issue can be exploited by a...

PT-2024-32883 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: A stack-based buffer overflow in IPsec allows a remote unauthenticated attacker to cause a denial of service. Recommendations: For versions prior to 22.7R2.3, update to version...

PT-2024-32882 · Ivanti · Ivanti Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions 22.4R2 through 22.7R2.2 Ivanti Policy Secure versions prior to 22.7R1.2 Description: The issue is related to excessive binary privileges, allowing a local authenticated attacker to escalate privileges...

PT-2024-32884 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Ivanti Policy Secure versions prior to 22.7R1.2 Description: A stack-based buffer overflow allows a remote authenticated attacker with admin privileges to cause a denial of service...

PT-2024-9043 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 and prior to 9.1R18.9 Ivanti Policy Secure versions prior to 22.7R1.1 and prior to 9.1R18.9 Description: The issue is related to argument injection in Ivanti Connect Secure and Ivanti Policy...

PT-2024-28646 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Ivanti Policy Secure versions prior to 22.7R1 Description: The issue is related to incorrect file permissions in Ivanti Connect Secure and Ivanti Policy Secure, allowing a local authenticated...

PT-2024-32881 · Ivanti · Ivanti Connect Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Ivanti Policy Secure versions prior to 22.7R1.2 Description: A stack-based buffer overflow allows a remote authenticated attacker with admin privileges to cause a denial of service...

PT-2024-8703 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to command injection, allowing a remote authenticated attacker with admin privileges to achieve remote code...

PT-2024-16695

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description The issue is related to a Reflected XSS that allows a remote unauthenticated attacker to obtain admin privileges, with user interactio...

PT-2024-28101 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Description: The issue is an out-of-bounds write in IPsec that allows a remote unauthenticated attacker to cause a denial of service. Recommendations: For versions prior to 22.7R2.1, update to...

PT-2024-27521 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: An out of bounds read allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service. Recommendations: For versions prior to 22.7R2.3, update to...

PT-2024-8721 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to incorrect input handling in Ivanti Connect Secure and Ivanti Policy Secure, allowing a remote attacker to...

VulnCheck KEV: CVE-2024-21894

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

CVE-2024-37404 affects Ivanti Connect Secure and Ivanti Policy Secure due to improper input validation in the admin portal, enabling remote code execution by an authenticated attacker. Affected: Ivanti Connect Secure 22.7R2.1/22.7R2.2 and 9.1R18.9; Ivanti Policy Secure 22.7R1.1 (and earlier). Roo...

Ivanti Connect Secure和Ivanti Policy Secure 安全漏洞

Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. Ivanti Connect Secure and Ivanti Policy Secure contain a security...