CVE-2020-13769

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

CVE-2020-13769

CVE-2020-13769 affects Ivanti Endpoint Manager (LDMS/alert_log.aspx) via the /remotecontrolauth/api/device endpoint, enabling SQL Injection through a user-controlled request. Public documents confirm the vulnerability exists in Ivanti Endpoint Manager up through version 2020.1 (and prior per CNVD...

CVE-2020-13772

Ivanti Endpoint Manager (up to version 2020.1.1) contains an unauthenticated information-disclosure issue in /ldclient/ldprov.cgi that allows an attacker to reveal server operating system details, local pathnames, and environment variables. Multiple sources (Red Hat, CNVD, CVE records, and ENISA-...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

CVE-2020-13773: Improper Neutralization of Input During Web Page Generation

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS/alertlog.aspx, /LDMS/ServerList.aspx, /LDMS/frmcoremainfrm.aspx, /LDMS/frmfindfrm.aspx, /LDMS/frmtaskfrm.aspx, and /LDMS/querybrowsecomp.aspx...

CVE-2020-13769: Improper Neutralization of Special Elements used in an SQL Command

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

Ivanti Endpoint Manager SQL注入漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An SQL injection vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions, which originates from the /remotecontrolauth/api/device request in LDMS/alertlog.aspx. No detailed...

CVE-2020-13772: Undefined Security Weakness

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An unauthorized access vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions, which originates in /ldclient/ldprov.cgi, and can be exploited by an attacker to disclose information...

Ivanti Endpoint Manager Cross-Site Scripting Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions that originates in /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS...

CVE-2020-13774

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...

CVE-2020-13774

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...

Unrestricted file upload

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...

CVE-2020-13774

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations ...

CVE-2020-13774

CVE-2020-13774 – Ivanti Endpoint Manager is affected by an unrestricted file-upload flaw in EditLaunchPadDialog.aspx, impacting 2019.1 and 2020.1. The issue stems from insufficient file-extension validation and insecure file operations on uploaded images, allowing an authenticated attacker to upl...

CVE-2020-13770

Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...

CVE-2020-13771

Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...

CVE-2020-13770

Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...

CVE-2020-13771

Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a nonexistent library file, allowing under certain conditions one to gain code execution and elevation of privileges to the level of privilege held by the vulnerable component such as NT...

Design/Logic Flaw

Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having...