Ivanti Endpoint Manager GetRulesetsSQL SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetRulesetsSQL method. The issue results from the lack of proper validation of a...

Ivanti Endpoint Manager RecordBrokenApp SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the RecordBrokenApp method. The issue results from the lac...

Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager

Ivanti on Tuesday rolled out fixes to address multiple critical security flaws in Endpoint Manager EPM that could be exploited to achieve remote code execution under certain circumstances. Six of the 10 vulnerabilities – from CVE-2024-29822 through CVE-2024-29827 CVSS scores: 9.6 – relate to SQL...

PT-2024-3894 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue exists due to the lack of neutralization of special elements used in the operating system command by the GetDBPatchProducts function in Ivanti EPM. This allows an unauthenticated...

Ivanti Endpoint Manager Mobile 安全漏洞

Ivanti Endpoint Manager Mobile Ivanti EPMM is a mobile management software engine from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager Mobile prior to version 12.1.0.0, which stems from a local elevation of privilege vulnerability that allows an authenticated...

Ivanti Endpoint Manager Mobile 安全漏洞

Ivanti Endpoint Manager Mobile Ivanti EPMM is a mobile management software engine from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager Mobile EPMM versions prior to 12.1.0.0, which originates from an SQL injection in the web component that allows an authenticat...

Ivanti Endpoint Manager Mobile 安全漏洞

Ivanti Endpoint Manager Mobile Ivanti EPMM is a mobile management software engine from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager Mobile EPMM versions prior to 12.1.0.0, which originates from an SQL injection in the web component that allows an authenticat...

KB Security Advisory EPM May 2024

Created Date May 21, 2024 4:07:53 PM...

Security Advisory May 2024

Last Modified Date Oct 14, 2024 11:00:26 PM...

PT-2024-4024 · Ivanti · Ivanti Secure Access Client For Windows

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client for Windows affected versions not specified Description: A local privilege escalation issue in Ivanti Secure Access Client for Windows allows a low-privileged user to execute code as SYSTEM. The vulnerability is...

PT-2024-4023 · Ivanti · Ivanti Secure Access Client For Linux

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client for Linux versions prior to 22.7R1 Description: A local privilege escalation issue allows a low-privileged user to execute code as root. The vulnerability is related to a buffer overflow in memory, which can be...

PT-2024-4022 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions 9.x through 9.x Ivanti Connect Secure versions 22.x through 22.x Description: The issue is related to a CRLF Injection vulnerability. This vulnerability can be exploited by a remote attacker using specially...

PT-2024-3759 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue allows an unauthenticated attacker within the same network to execute arbitrary code due to an unspecified SQL Injection vulnerability in the Core server. This can be exploited by...

PT-2024-4036 · Ivanti · Ivanti Neurons For Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti Neurons for ITSM affected versions not specified Description: The issue is related to an unrestricted file upload vulnerability in the web component of Ivanti Neurons for ITSM. This vulnerability allows a remote, authenticated,...

PT-2024-4021 · Ivanti · Ivanti Neurons For Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti Neurons for ITSM affected versions not specified Description: The issue is related to a SQL injection vulnerability in the web component of Ivanti Neurons for ITSM, due to inadequate protection of the SQL query structure. This...

CISA Warns of Actively Exploited D-Link Router Vulnerabilities - Patch Now

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added two security flaws impacting D-Link routers to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2014-100005 - A cross-site...

Exploit for Improper Access Control in Ivanti Endpoint_Manager_Mobile

CVE-2024-22026 Exploit POC for CVE-2024-22026 affecting Ivan...

VulnCheck KEV: CVE-2023-41724

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network...

VulnCheck KEV: CVE-2023-46808

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user...

Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery

Two recently disclosed security flaws in Ivanti Connect Secure ICS devices are being exploited to deploy the infamous Mirai botnet. That's according to findings from Juniper Threat Labs, which said the vulnerabilities CVE-2023-46805 and CVE-2024-21887 have been leveraged to deliver the botnet...