PT-2024-8721 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to incorrect input handling in Ivanti Connect Secure and Ivanti Policy Secure, allowing a remote attacker to...

VulnCheck KEV: CVE-2024-21894

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution...

The vulnerability of the Ivanti Cloud Services Appliance’s network interface, related to incorrect path name restrictions for the restricted access catalog, allows attackers to escalate their privileges.

The vulnerability of the Ivanti Cloud Services Appliance relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the Ivanti Cloud Services Appliance’s networking component, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability of the Ivanti Cloud Services Appliance relates to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the web-based console of the network device Ivanti Cloud Services Appliance allows a hacker to execute arbitrary code.

The vulnerability of the network device administrator web console of Ivanti Cloud Services Appliance is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-29213

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-29213

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29821

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29821

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29821

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-37404

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution...

CVE-2024-29821

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29213

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29213

CVE-2024-29213 affects Ivanti Desktop and Server Management (Ivanti DSM) and leverages an insecure ACL to allow an authenticated local user to execute code with elevated privileges. The advisory and multiple feeds confirm the vulnerability exists in DSM versions prior to 2024.2, with a CVSS v3 ba...

CVE-2024-37404

CVE-2024-37404 affects Ivanti Connect Secure and Ivanti Policy Secure due to improper input validation in the admin portal, enabling remote code execution by an authenticated attacker. Affected: Ivanti Connect Secure 22.7R2.1/22.7R2.2 and 9.1R18.9; Ivanti Policy Secure 22.7R1.1 (and earlier). Roo...

CVE-2024-29213

Ivanti DSM version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector...

CVE-2024-29821

CVE-2024-29821 affects Ivanti Desktop and Server Management (DSM) prior to 2024.2. The vulnerability allows authenticated local users to execute code with elevated privileges due to insecure ACLs, via an unspecified attack vector. Public sources confirm impact is a local privilege escalation with...