CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-29211

A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files...

CVE-2024-32847

CVE-2024-32847 describes a SQL injection in Ivanti Endpoint Manager that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Public sources in the connected documents confirm the vulnerability, with Red Hat and NVD entries providing the same descripti...

CVE-2024-39710

CVE-2024-39710 involves argument injection in Ivanti Connect Secure (pre-22.7R2.1) and Ivanti Policy Secure (pre-22.7R1.1). An authenticated admin can exploit the web interfaces to achieve remote code execution. The issue affects the web-facing components and is reported with a 9.1/CRITICAL CVSS....

CVE-2024-38654

Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of service...

CVE-2024-38649

An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1Not Applicable to 9.1Rx allows a remote unauthenticated attacker to cause a denial of service...

CVE-2024-39709

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1 Not Applicable to 9.1Rx allow a local authenticated attacker to escalate their privileges...

CVE-2024-34780

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34780

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34781

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34784

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-29211

A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files...

CVE-2024-38655

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-37376

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-37398

Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges...

CVE-2024-39712

CVE-2024-39712 describes an argument injection vulnerability in Ivanti Connect Secure prior to 22.7R2.1 and 9.1R18.7, and Ivanti Policy Secure prior to 22.7R1.1, that allows a remote authenticated attacker with administrative privileges to achieve remote code execution via the web interface (note...

CVE-2024-34782

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32839

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34787

Ivanti Endpoint Manager is affected by a path traversal vulnerability (CVE-2024-34787) that can allow code execution with local unauthenticated access and requires user interaction. The issue affects versions prior to the 2024 November Security Update and 2022 SU6 November Security Update. Ivanti...

CVE-2024-39709

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1 Not Applicable to 9.1Rx allow a local authenticated attacker to escalate their privileges...