CVE-2024-22059: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlying database. This may also lead to DoS...

Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager

Ivanti on Tuesday rolled out fixes to address multiple critical security flaws in Endpoint Manager EPM that could be exploited to achieve remote code execution under certain circumstances. Six of the 10 vulnerabilities – from CVE-2024-29822 through CVE-2024-29827 CVSS scores: 9.6 – relate to SQL...

Security Advisory May 2024

Last Modified Date Oct 14, 2024 11:00:26 PM...

PT-2024-4021 · Ivanti · Ivanti Neurons For Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti Neurons for ITSM affected versions not specified Description: The issue is related to a SQL injection vulnerability in the web component of Ivanti Neurons for ITSM, due to inadequate protection of the SQL query structure. This...

PT-2024-4036 · Ivanti · Ivanti Neurons For Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti Neurons for ITSM affected versions not specified Description: The issue is related to an unrestricted file upload vulnerability in the web component of Ivanti Neurons for ITSM. This vulnerability allows a remote, authenticated,...

The vulnerability of the IT services management tool Ivanti Neurons for ITSM lies in its ability to download files of a dangerous type without limitation, allowing an attacker to execute arbitrary commands.

The vulnerability of the IT services management tool Ivanti Neurons for ITSM is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by introducing specially crafted files...

Patch Ivanti Standalone Sentry and Ivanti Neurons for ITSM now

Ivanti has issued patches for two vulnerabilities. One was discovered in the Ivanti Standalone Sentry, which impacts all supported versions 9.17.0, 9.18.0, and 9.19.0. Older versions are also at risk. The other vulnerability impacts all supported versions of Ivanti Neurons for ITSM—2023.3, 2023.2...

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

Ivanti has disclosed details of a critical remote code execution flaw impacting Standalone Sentry, urging customers to apply the fixes immediately to stay protected against potential cyber threats. Tracked as CVE-2023-41724, the vulnerability carries a CVSS score of 9.6. "An unauthenticated threa...

SA: CVE-2023-46808 (Authenticated Remote File Write) for Ivanti Neurons for ITSM

Created Date Mar 20, 2024 2:26:49 AM...

The vulnerability of Ivanti Connect Secure (previously known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons for Zero Trust Access (nZTA) – tools for authentication and access control – stems from incorrect restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information.

The vulnerability of Ivanti Connect Secure previously Pulse Connect Secure and Ivanti Policy Secure, as well as the authentication and access control management tools Ivanti Neurons for Zero Trust Access nZTA, is related to an incorrect restriction on XML links to external objects. Exploiting thi...

Exploit for Server-Side Request Forgery in Ivanti Connect_Secure

CVE-2024-21893 is server-side request forgery vulnerability in...

CVE-2024-21893

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication...

CVE-2024-21893

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication...

Server side request forgery (ssrf)

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication...

CVE-2024-21893

Technical details about CVE-2024-21893 are not provided in the connected documents. The initial description notes an SSRF vulnerability in Ivanti products, but there are no product/version specifics or remediation details here. Monitor for updates.

CVE-2024-21893

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. Recent assessments: ccondon-r7 at February 02, 2024...

CVE-2024-21893: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication...

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Ivanti Connect Secure ICS, formerly known as Pulse Connect Secure, Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery SSRF vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication...

VulnCheck KEV: CVE-2024-21893

Ivanti Connect Secure ICS, formerly known as Pulse Connect Secure, Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery SSRF vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication...

[updated] Ivanti Sentry critical vulnerability—don't play dice, patch

Ivanti has published a security blog post about a vulnerability in Ivanti Sentry, formerly MobileIron Sentry. Successful exploitation of the vulnerability would enable an unauthenticated attacker to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal...