CVE-2024-32844

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34784

Ivanti Endpoint Manager (EPM) 2024 and earlier versions are affected by CVE-2024-34784 due to a SQL injection that allows a remote authenticated attacker with admin privileges to achieve remote code execution. The vulnerability is reported in the Ivanti advisory and corroborated by Red Hat, NVD, ...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39712

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32839

Ivanti Endpoint Manager is affected by a SQL injection vulnerability (CVE-2024-32839) that exists before the 2024 November Security Update or 2022 SU6 November Security Update. The issue allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public sources ...

CVE-2024-39709

CVE-2024-39709 involves Ivanti Connect Secure and Ivanti Policy Secure where the root cause is incorrect file permissions. A local, authenticated attacker can escalate privileges on affected builds prior to 22.6R2 (Connect Secure) and prior to 22.7R1 (Policy Secure). Connected documents confirm t...

CVE-2024-39711

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34784

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34782

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-38656

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32847

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34787

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required...

CVE-2024-37398

Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges...

CVE-2024-37400

An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service...

CVE-2024-37400

An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service...

CVE-2024-29211

A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files...

CVE-2024-32847

CVE-2024-32847 describes a SQL injection in Ivanti Endpoint Manager that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Public sources in the connected documents confirm the vulnerability, with Red Hat and NVD entries providing the same descripti...

CVE-2024-39710

CVE-2024-39710 involves argument injection in Ivanti Connect Secure (pre-22.7R2.1) and Ivanti Policy Secure (pre-22.7R1.1). An authenticated admin can exploit the web interfaces to achieve remote code execution. The issue affects the web-facing components and is reported with a 9.1/CRITICAL CVSS....

CVE-2024-32847

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...