PT-2024-6213

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions before 2022 SU6 Ivanti EPM versions before the 2024 September update Description The issue is related to weak authentication in the Patch Management of Ivanti EPM, allowing a remote authenticated attacker to access restrict...

CVE-2024-8322: Weak Authentication

Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality...

CVE-2024-8321: Missing Authentication for Critical Function

Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network...

PT-2024-6217

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description The issue is related to an unspecified SQL injection in Ivanti EPM, which may allow a remote authenticated attacker with admin privileges ...

CVE-2024-8191: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2024-8441: Uncontrolled Search Path Element

An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM...

PT-2024-6588 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions before 2022 SU6 Ivanti EPM versions before the 2024 September update Description: The issue is related to SQL injection in the management console of Ivanti EPM, allowing a remote unauthenticated attacker to achieve remote...

PT-2024-6216 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to a lack of authentication for a critical function in Ivanti EPM, specifically in Network Isolation. This allows a...

CVE-2024-37381

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-37381

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-37381

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-37381

Ivanti Endpoint Manager (EPM) 2024 flat is affected by an unspecified SQL injection vulnerability in the Core server. The issue allows an authenticated attacker on the same network to execute arbitrary code. Public references indicate a July 2024 hotfix/patch to address this, but details vary by ...

CVE-2024-37381

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code...

CVE-2024-37381: Improper Neutralization of Special Elements used in an SQL Command

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code...

Ivanti EPM Cloud Services Appliance < 4.6.0-512 Remote Code Execution

Ivanti EPM Cloud Services Appliance versions prior to 4.6.0-512 is affected by a vulnerability allowing an unauthenticated attacker to execute remote code via a specially forged request with limited permissions nobody. No source data...

PT-2024-27510 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM 2024 flat Description: The issue is related to an unspecified SQL Injection flaw in the core server, allowing an authenticated attacker within the same network to execute arbitrary code. Recommendations: For Ivanti EPM 2024 flat, a...

Security Advisory EPM July 2024 for EPM 2024

Created Date 16 Jul 2024 16:16:53...

Ivanti EPM RecordGoodApp SQL Injection / Remote Code Execution Exploit

Ivanti Endpoint Manager EPM 2022 SU5 and prior versions are susceptible to an unauthenticated SQL injection vulnerability which can be leveraged to achieve unauthenticated remote code execution. This module requires Metasploit: https://metasploit.com/download Current source:...

Ivanti Endpoint Manager < 2022 (CVE-2024-22058)

The version of Ivanti Endpoint Manager installed on the remote host is prior to 2022. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22058 advisory. - A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute...

PT-2024-6317 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to an unspecified SQL injection in Ivanti EPM, which may allow a remote authenticated attacker with admin privilege...