Ivanti Avalanche Manager 安全漏洞

Ivanti Avalanche Manager is an enterprise mobile device management system developed by Ivanti for managing smartphones, tablets and other mobile devices. A buffer overflow vulnerability exists in Ivanti Avalanche Manager, which arises from a program that does not properly manage memory allocation...

PT-2025-29292 · Ivanti · Ivanti Dsm

Name of the Vulnerable Software and Affected Versions: Ivanti DSM versions prior to 2024.2 Description: A hardcoded secret within the software allows an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Recommendations: Update Ivanti DSM to versi...

Ivanti Sentry 安全漏洞

Ivanti Sentry is an in-line gateway from Ivanti USA, Inc. used to manage, encrypt, and protect traffic between mobile devices and back-end enterprise systems. A security vulnerability exists in Ivanti Sentry that stems from an authenticated user being able to access Sentry-protected services, eve...

Ivanti Policy Secure 安全漏洞

Ivanti Policy Secure IPS is a network access control NAC solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Policy Secure IPS versions prior to 22.6R1 that originates from an authenticated administrator being able to perform arbitrary file reads via a specially craft...

Ivanti Endpoint Manager Mobile 12.5.0.x < 12.5.0.2 / 12.4.0.x < 12.4.0.3 / 12.x < 12.3.0.3 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 12.5.0.x prior to 12.5.0.2, 12.4.0.x prior to 12.4.0.3, or 12.x prior to 12.3.0.3. It is, therefore, affected by multiple vulnerabilities: - OS command injection in Ivanti Endpoint Manager Mobil...

Ivanti Endpoint Manager < 2022 SU8 Security Update 1 / 2024 < 2024 SU3 July 2025 Security Update

The version of Ivanti Endpoint Manager running on the remote host is prior to 2022 SU8 Security Update 1 or 2024 prior to 2024 SU3. It is, therefore, affected by multiple vulnerabilities: - Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8...

CVE-2025-5464

Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information...

CVE-2025-6771

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-0293

CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk...

CVE-2025-0292

SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services...

CVE-2025-5450

Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted...

CVE-2025-6996

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords...

CVE-2025-5463

Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information...

CVE-2025-6995

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords...

CVE-2025-6770

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-7037

SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database...

CVE-2025-5451

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service...

CVE-2025-6771

OS command injection in Ivanti Endpoint Manager Mobile EPMM before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution...

CVE-2025-5464

Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information...

CVE-2025-5464

Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information...