CVE-2024-34785

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32840

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32845

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32843

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32848

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-34779

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-37397

CVE-2024-37397 is an XXE vulnerability in Ivanti Endpoint Manager (EPM) provisioning web service. It affects EPM 2022 SU5 and earlier, and 2024.s September update/pre-release lines, allowing a remote unauthenticated attacker to leak API secrets. The issue stems from external XML entity handling i...

CVE-2024-29847

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2024-32848

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32842

CVE-2024-32842 is an unspecified SQL injection in Ivanti Endpoint Manager (EPM) that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Technical context across connected sources indicates the vulnerability affects EPM versions prior to the 2022 SU6 ...

CVE-2024-32840

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32840

CVE-2024-32840 affects Ivanti Endpoint Manager (EPM). The reported issue is an unspecified SQL injection in EPM before the 2024 September update (or the 2024 September update) that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public documents from...

CVE-2024-32846

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32845

Ivanti Endpoint Manager (EPM) is affected by an unspecified SQL injection vulnerability (CVE-2024-32845) that can allow a remote authenticated attacker with admin privileges to achieve remote code execution. Technical details across connected sources confirm impact on EPM 2022 SU6 and 2024 Septem...

CVE-2024-34779

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-32843

CVE-2024-32843 affects Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier, and 2024-era installations before the September 2024 update. The vulnerability is an unspecified SQL injection in Ivanti EPM that, when combined with a remote authenticated admin, enables remote code execution. Evidence fr...

CVE-2024-29847

CVE-2024-29847 is a deserialization-of-untrusted-data vulnerability in Ivanti Endpoint Manager (AgentPortal) that enables remote code execution on Ivanti EPM installations running pre-2022 SU6 or the 2024 September update. Public materials in connected docs confirm remote, unauthenticated RCE wit...

CVE-2024-29847

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2024-34783

CVE-2024-34783 is an unspecified SQL injection in Ivanti Endpoint Manager (EPM) before 2022 SU6, or the 2024 September update, that allows a remote authenticated attacker with admin privileges to achieve remote code execution. Public sources in the connected set (Red Hat, NVD/NCSC, Nessus advisor...

CVE-2024-34783

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution...