Blue Cedar partners with Microsoft to combat BYOD issues

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Bring Your Own Device BYOD has been a divisive topic within corporations for years. Employees wanted the convenience of working on their own smart devices, and business decision-make...

Ivanti Endpoint Manager SQL Injection Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An SQL injection vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions, which originates from the /remotecontrolauth/api/device request in LDMS/alertlog.aspx. No detailed...

Ivanti Endpoint Manager Unauthorized Access Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An unauthorized access vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions, which originates in /ldclient/ldprov.cgi, and can be exploited by an attacker to disclose information...

CVE-2020-13769

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

CVE-2020-13773

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS/alertlog.aspx, /LDMS/ServerList.aspx, /LDMS/frmcoremainfrm.aspx, /LDMS/frmfindfrm.aspx, /LDMS/frmtaskfrm.aspx, and /LDMS/querybrowsecomp.aspx...

CVE-2020-13769

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

CVE-2020-13773

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS/alertlog.aspx, /LDMS/ServerList.aspx, /LDMS/frmcoremainfrm.aspx, /LDMS/frmfindfrm.aspx, /LDMS/frmtaskfrm.aspx, and /LDMS/querybrowsecomp.aspx...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

Authentication flaw

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

Sql injection

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

Design/Logic Flaw

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS/alertlog.aspx, /LDMS/ServerList.aspx, /LDMS/frmcoremainfrm.aspx, /LDMS/frmfindfrm.aspx, /LDMS/frmtaskfrm.aspx, and /LDMS/querybrowsecomp.aspx...

CVE-2020-13773

CVE-2020-13773 affects Ivanti Endpoint Manager up to version 2020.1.1. The issue is an XSS vulnerability that can be triggered via multiple web endpoints: /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremai...

CVE-2020-13773

Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS/alertlog.aspx, /LDMS/ServerList.aspx, /LDMS/frmcoremainfrm.aspx, /LDMS/frmfindfrm.aspx, /LDMS/frmtaskfrm.aspx, and /LDMS/querybrowsecomp.aspx...

CVE-2020-13769

LDMS/alertlog.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request...

CVE-2020-13769

CVE-2020-13769 affects Ivanti Endpoint Manager (LDMS/alert_log.aspx) via the /remotecontrolauth/api/device endpoint, enabling SQL Injection through a user-controlled request. Public documents confirm the vulnerability exists in Ivanti Endpoint Manager up through version 2020.1 (and prior per CNVD...

CVE-2020-13772

Ivanti Endpoint Manager (up to version 2020.1.1) contains an unauthenticated information-disclosure issue in /ldclient/ldprov.cgi that allows an attacker to reveal server operating system details, local pathnames, and environment variables. Multiple sources (Red Hat, CNVD, CVE records, and ENISA-...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

Ivanti Endpoint Manager SQL注入漏洞

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti, USA. An SQL injection vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions, which originates from the /remotecontrolauth/api/device request in LDMS/alertlog.aspx. No detailed...

Ivanti Endpoint Manager Cross-Site Scripting Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager version 2020.1.1 and prior versions that originates in /LDMS/frmsplitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frmsplitcollapse.aspx, /LDMS...