CVE-2025-5456

CVE-2025-5456 is a buffer over-read in Ivanti Connect Secure prior to 22.7R2.8 or 22.8R2, Ivanti Policy Secure prior to 22.7R1.5, Ivanti ZTA Gateway prior to 2.8R2.3-723, and Ivanti Neurons for Secure Access prior to 22.8R1.4. The issue allows a remote unauthenticated attacker to trigger a denial...

CVE-2025-5456

A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote unauthenticated attacker to trigger a...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

CVE-2025-8310

CVE-2025-8310 affects Ivanti Virtual Application Delivery Controller (vADC) prior to 22.9. The admin console lacks proper authorization, enabling a remote authenticated attacker to take over admin accounts by resetting passwords. The vulnerability is mitigated by updating to version 22.9 or later...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

CVE-2025-8297

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-8297

CVE-2025-8297 affects Ivanti Avalanche prior to version 6.4.8.8008. Multiple sources describe an incomplete configuration restriction that enables a remote authenticated attacker with admin privileges to achieve remote code execution. The confirmed impact is remote code execution with high severi...

CVE-2025-8297

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-8297

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2025-8296

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution...

CVE-2025-8296

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution...

CVE-2025-8296

Ivanti Avalanche contains a SQL injection vulnerability in versions before 6.4.8.8008. The issue arises from improper validation of user-entered SQL statements, enabling a remote authenticated attacker with admin privileges to execute arbitrary SQL queries and, under certain conditions, achieve r...

August Security Advisory Ivanti Virtual Application Delivery Controller (vADC previously vTM) (CVE-2025-8310)

Summary Ivanti has released updates for Ivanti Virtual Application Delivery Controller vADC, previously Virtual Traffic Manager vTM, which addresses one medium severity vulnerability. Successful exploitation could lead to account takeover. We are not aware of any customers being exploited by this...

August Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (Multiple CVEs)

Summary Ivanti has released updates for Ivanti Connect Secure which addresses medium, high, and critical vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score Severity |...

Ivanti多款产品 安全漏洞

Ivanti Connect Secure ICS and others are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti ZTA Gateway is a component of network access software. A security vulnerability...

PT-2025-32675 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.8.8008 Description: A SQL injection issue exists in Ivanti Avalanche. A remote authenticated attacker with admin privileges can execute arbitrary SQL queries. In certain conditions, this can also lead to...

PT-2025-32680 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 Ivanti Connect Secure versions prior to 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3 Ivanti Neurons for Secure Access versions prior to...

PT-2025-32678 · Ivanti · Ivanti Neurons For Secure Access +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 and 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4 Description: A heap-base...

Ivanti多款产品 安全漏洞

Ivanti Connect Secure ICS, among others, are products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure IPS is a network access control NAC solution.Ivanti Neurons Ivanti Neurons for Secure is a secure cloud technology platform. A...

PT-2025-32679 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 and 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4 Description: An XML...