4473 matches found
Ivanti Desktop and Server Management 安全漏洞
Ivanti Desktop and Server Management Ivanti DSM is a multi-platform, unified endpoint management solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Desktop and Server Management versions prior to 2024.2. An attacker could exploit the vulnerability to elevate privileg...
Ivanti Desktop and Server Management 安全漏洞
Ivanti Desktop and Server Management Ivanti DSM is a multi-platform, unified endpoint management solution from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Desktop and Server Management versions prior to 2024.2. An attacker could exploit the vulnerability to elevate privileg...
Ivanti Connect Secure和Ivanti Policy Secure 安全漏洞
Ivanti Connect Secure and Ivanti Policy Secure are both products of Ivanti Corporation, U.S.A. Ivanti Connect Secure is a secure remote network connection tool.Ivanti Policy Secure is a network access control NAC solution. Ivanti Connect Secure and Ivanti Policy Secure contain a security...
PT-2024-23068 · Ivanti · Ivanti Dsm
Name of the Vulnerable Software and Affected Versions: Ivanti DSM versions prior to 2024.2 Description: The issue allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via an unspecified attack vector. Recommendations: For Ivanti DSM versions pri...
The vulnerability of the Ivanti Velocity License Server for mobile devices lies in its lack of access control mechanisms, which allows attackers to increase their privileges.
The vulnerability of the Ivanti Velocity License Server for mobile devices is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the validateAMCWSConnection method in the Ivanti Avalanche mobile device management system allows a hacker to disclose protected information.
The vulnerability of the validateAMCWSConnection method in the Ivanti Avalanche mobile device management system is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose protected information...
The vulnerability of the SecureFilter component in the Ivanti Avalanche mobile device management system allows a hacker to bypass existing security restrictions.
The vulnerability of the SecureFilter component in the Ivanti Avalanche mobile device management system is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions...
The vulnerability of the allowPassThrough method implemented in the Ivanti Avalanche mobile device management system allows a hacker to circumvent existing security restrictions.
The vulnerability of the allowPassThrough method in the Ivanti Avalanche mobile device management system is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions...
Ivanti Avalanche < 6.4.5 Multiple Vulnerabilities
The version of Ivanti Avalanche running on the remote host is prior to 6.4.5. It is, therefore, is affected by multiple vulnerabilities : - A NULL pointer dereference in WLAvalancheService allows a remote unauthenticated attacker to crash the service. CVE-2024-47007 - Server-side request forgery...
Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration
A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance CSA as zero-days to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain...
The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the failure to handle CRLF sequences properly, allows a violator to execute arbitrary code.
The vulnerability of Ivanti Connect Secure previously known as Pulse Connect Secure and Ivanti Policy Secure lies in the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges by...
Ivanti Endpoint Manager Mobile < 12.0.0.5, 12.1.x < 12.1.0.4 Improper Authorization (CVE-2024-7612)
The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.0.0.5 or prior to 12.1.0.4. It is, therefore, affected by an improper authorization vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the...
Ivanti Policy Secure 22.x < 22.7R1.1 RCE
The Ivanti Policy Secure installed on the remote host is prior to 22.7R1.1. It is, therefore, affected by a remote code execution vulnerability due to improper input validation in the admin portal. Note that Nessus has not tested for this issue but has instead relied only on the application's...
Ivanti Connect Secure 9.1Rx < 9.1R18.9 / 22.x < 22.7R2.1 RCE
The Ivanti Connect Secure installed on the remote host is 9.1Rx prior to 9.1R18.9, 22.x prior to 22.7R2.1. It is, therefore, affected by a remote code execution vulnerability due to improper input validation in the admin portal. Note that Nessus has not tested for this issue but has instead relie...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-23113link is external Fortinet Multiple Products Format String Vulnerability CVE-2024-9379link is external Ivanti Cloud Services Appliance CSA SQL Injection...
Vulnerability fixed in Ivanti Endpoint Manager Mobile
Ivanti has fixed a vulnerability in Endpoint Manager Mobile. A locally authenticated malicious party could exploit the vulnerability to obtain read and write permissions to sensitive configuration files. Ivanti has released updates to fix the vulnerability in Endpoint Manager Mobile. See the...
Vulnerabilities fixed in Ivanti Avalanche
Ivanti has fixed vulnerabilities in Avalanche. The vulnerabilities potentially enable a malicious person to carry out attacks that can lead to the following categories of damage: Denial-of-Service DoS. Bypassing authentication Bypassing security measure Accessing sensitive data Ivanti has release...
Vulnerabilities fixed in Ivanti Cloud Services Appliance
Ivanti has fixed three vulnerabilities in Cloud Services Appliance. An authenticated malicious person who already has admin rights can exploit the vulnerabilities to remotely execute code and SQL statements, or bypass restrictions through path traversal. Ivanti reports that users of version 4.6...
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Ivanti Cloud Services Appliance CSA contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS...
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
Ivanti Cloud Services Appliance CSA contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements...