CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

Arbitrary file deletion

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...

Xxe

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

PT-2023-26374 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2022 SU4 Description: A file disclosure issue exists in the GetFileContents SOAP action exposed via "/landesk/managementsuite/core/core.secure/OsdScript.asmx". The application does not sufficiently...

CVE-2023-38344

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...

Ivanti Endpoint Manager Security Vulnerability

Ivanti Endpoint Manager is a suite of endpoint security managers from Ivanti USA.Contents is a product analytics solution and innovation enabler for the Countly Team team. Helps teams track product performance, customer journeys and behaviors across mobile, web and desktop applications. A securit...

CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

CVE-2023-38344

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...

CVE-2023-38343

An XXE XML external entity injection vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery...

CVE-2023-38344

Affected software: Ivanti Endpoint Manager prior to 2022 SU4. Vulnerability: GetFileContents SOAP action in /landesk/managementsuite/core/core.secure/OsdScript.asmx allows reading arbitrary remote files when user-supplied paths aren’t properly restricted. Impact: authenticated attacker can read s...

CVE-2023-38343

CVE-2023-38343 describes an XXE vulnerability in the CSEP component of Ivanti Endpoint Manager prior to 2022 SU4. External entity references are enabled in the XML parser, enabling potential file disclosure and SSRF. CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); attack vector is ...

Ivanti Endpoint Manager Code Issue Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager versions prior to 2022 SU4, which stems from the presence of XML External Entity Injection in the CSEP component, where external entity...

PT-2023-28158 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX affected versions not specified Description: A security issue has been identified in Endpoint Manager and Rest Apps of FreePBX. The estimated number of potentially affected devices worldwide is not specified. There is no information...

Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile

CVE-2023-35078 Ivanti Endpoi...

The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and mobile applications (formerly known as MobileIron Core) lies in the improper restriction of the path name to the restricted directory. This allows a malicious user to write arbitrary files.

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM application for managing the lifecycle of mobile devices and mobile applications formerly known as MobileIron Core is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could...

Vulnerability fixed in Ivanti Endpoint manager Mobile (EPMM, formerly MobileIron Core).

A vulnerability has been fixed in Ivanti Endpoint Manager formerly MobileIron Core. An unauthenticated malicious person could exploit the vulnerability to access arbitrary files thus gaining access to sensitive data and potentially execute arbitrary code on the vulnerable system. This vulnerabili...

Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile

🕵️ Vulnerability Scanner 🛡️ This Python script helps you scan...

Ivanti Endpoint Manager Mobile Remote Unauthenticated API Access (CVE-2023-35082)

Binary data ivantiendpointmanagermobileCVE-2023-35082.nbin...

Ivanti Endpoint Manager Mobile < 11.3 Remote Unauthenticated API Access (CVE-2023-35082)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 11.3. It is, therefore, affected by an undisclosed unauthenticated API access vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the service's...

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability

When this blog was originally published on August 2, it said that CVE-2023-35082 only affected MobileIron Core 11.2 and earlier, which are unsupported. On August 7, Ivanti published an updated advisory noting that since originally disclosing CVE-2023-35082, they have continued their investigation...