4408 matches found
CVE-2020-13774
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...
CVE-2020-13774
CVE-2020-13774 – Ivanti Endpoint Manager is affected by an unrestricted file-upload flaw in EditLaunchPadDialog.aspx, impacting 2019.1 and 2020.1. The issue stems from insufficient file-extension validation and insecure file operations on uploaded images, allowing an authenticated attacker to upl...
CVE-2020-13770
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...
CVE-2020-13771
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...
CVE-2020-13770
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...
CVE-2020-13771
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...
Design/Logic Flaw
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...
Design/Logic Flaw
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...
CVE-2020-13770
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...
CVE-2020-13770
CVE-2020-13770 affects Ivanti Endpoint Manager (version ~2020.1.1) where several services run as SYSTEM access named pipes with default/overly permissive security attributes. This can allow privilege escalation from a local account that has SeImpersonatePrivilege (e.g., NETWORK SERVICE). The conn...
CVE-2020-13771
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...
CVE-2020-13771
CVE-2020-13771 affects Ivanti Endpoint Manager up to 2020.1.1. The vulnerability arises when certain executables (ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, ldprofile.exe) load a nonexistent library file, relying on Windows search order, which can lead to code execution and privile...
VulnCheck KEV: CVE-2020-15505
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database RDB products contain an unspecified vulnerability that allows for remote code execution...
Microsoft Patch Tuesday, October 2020 Edition
Its Cybersecurity Awareness Month! In keeping with that theme, if you abuse Microsoft Windows computers you should be aware the company shipped a bevy of software updates today to fix at least 87 security problems in Windows and programs that run on top of the operating system. That means its onc...
CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
CVE-2020-13793
Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key...
CVE-2020-12441
Denial-of-Service DoS in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet...
CVE-2020-12441
Denial-of-Service DoS in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet...
Buffer overflow
Denial-of-Service DoS in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet...