CVE-2024-37397

An External XML Entity XXE vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets...

CVE-2024-34783

CVE-2024-34783 is an unspecified SQL injection in Ivanti Endpoint Manager (EPM) before 2022 SU6, or the 2024 September update, that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public sources in the connected set (Red Hat, NVD/NCSC, Nessus advisor...

CVE-2024-34779

Ivanti Endpoint Manager (EPM) has multiple CVEs for unspecified SQL injection vulnerabilities that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. CVE-2024-34779 is among these issues; related entries (CVE-2024-32840, -32842, -32843, -32845, -3284...

CVE-2024-32846

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32842

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32840

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32840

CVE-2024-32840 affects Ivanti Endpoint Manager (EPM). The reported issue is an unspecified SQL injection in EPM before the 2024 September update (or the 2024 September update) that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public documents from...

CVE-2024-34785

CVE-2024-34785 details (Ivanti Endpoint Manager EPM): An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update, allows a remote authenticated attacker with admin privileges to achieve remote code execution. Affected versions include Ivanti Endpoint Manager 2024 and...

CVE-2024-29847

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2024-34783

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34783

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34785

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32843

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32846

CVE-2024-32846 is an unspecified SQL injection in Ivanti Endpoint Manager (EPM) that, before 2022 SU6 or the 2024 September update, can be exploited by a remote authenticated attacker with admin privileges to achieve remote code execution. Affected products/versions include EPM 2022 SU5 and earli...

CVE-2024-29847

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2024-37397

CVE-2024-37397 is an XXE vulnerability in Ivanti Endpoint Manager (EPM) provisioning web service. It affects EPM 2022 SU5 and earlier, and 2024.s September update/pre-release lines, allowing a remote unauthenticated attacker to leak API secrets. The issue stems from external XML entity handling i...

CVE-2024-37397

An External XML Entity XXE vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets...

CVE-2024-29847

CVE-2024-29847 is a deserialization-of-untrusted-data vulnerability in Ivanti Endpoint Manager (AgentPortal) that enables remote code execution on Ivanti EPM installations running pre-2022 SU6 or the 2024 September update. Public materials in connected docs confirm remote, unauthenticated RCE wit...

Ivanti Endpoint Manager 代码问题漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. A code issue vulnerability exists in Ivanti Endpoint Manager version 2024 and 2022 SU5 and earlier versions, which arises from deserialization of untrusted data and allows remote unauthenticated attackers to...

Ivanti Endpoint Manager SQL注入漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti USA. An SQL injection vulnerability exists in Ivanti Endpoint Manager. An attacker exploiting this vulnerability could remotely execute code...