482 matches found
Ivanti EPM Security Vulnerability
Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. A security vulnerability exists in Ivanti EPM 2022 SU5 and prior versions, which stems from the presence of SQL injection that allows an authenticated attacker within the same network to execute...
Ivanti EPM SQL注入漏洞
Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. An SQL injection vulnerability exists in Ivanti EPM 2022 SU5 and prior versions, which can be exploited by an attacker to execute arbitrary code...
Ivanti EPM 安全漏洞
Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. An SQL injection vulnerability exists in Ivanti EPM 2022 SU5 and prior versions, which can be exploited by an attacker to execute arbitrary code...
CVE-2024-29824
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Recent assessments: cdelafuente-r7 at July 23, 2024 8:10am UTC reported: Ivanti Endpoint Manager EPM versions 2022 SU5 a...
PT-2024-19174 · Ivanti · Ivanti Epm
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2021.1 and older Description: A buffer overflow issue allows a low-privilege user on the local machine with the EPM Agent installed to execute arbitrary code with elevated permissions. Recommendations: For Ivanti EPM...
The vulnerability of the Ivanti EPM 2022 SU5 endpoint management software lies in its lack of measures to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary code.
The vulnerability of the Ivanti EPM 2022 SU5 endpoint management software exists due to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting specially...
PT-2024-3894 · Ivanti · Ivanti Epm
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue exists due to the lack of neutralization of special elements used in the operating system command by the GetDBPatchProducts function in Ivanti EPM. This allows an unauthenticated...
PT-2024-3759 · Ivanti · Ivanti Epm
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue allows an unauthenticated attacker within the same network to execute arbitrary code due to an unspecified SQL Injection vulnerability in the Core server. This can be exploited by...
PT-2024-4018 · Ivanti · Ivanti Epm
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue is related to an unspecified SQL Injection vulnerability in the Core server of Ivanti EPM, allowing an unauthenticated attacker within the same network to execute arbitrary code...
PT-2024-4016 · Ivanti · Ivanti Epm +1
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions 2022 SU5 and prior Description: The issue is related to an unspecified SQL Injection vulnerability in the Core server of Ivanti EPM, allowing an unauthenticated attacker within the same network to execute arbitrary code...
Alert: Ivanti Releases Patch for Critical Vulnerability in Endpoint Manager Solution
Ivanti has released security updates to address a critical flaw impacting its Endpoint Manager EPM solution that, if successfully exploited, could result in remote code execution RCE on susceptible servers. Tracked as CVE-2023-39336, the vulnerability has been rated 9.6 out of 10 on the CVSS...
epm.it Cross Site Scripting vulnerability OBB-3484029
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-28323
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS Operating System vulnerabilities to escalate privileges on the machine or be used as a...
CVE-2023-28323
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS Operating System vulnerabilities to escalate privileges on the machine or be used as a...
Deserialization of untrusted data
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS Operating System vulnerabilities to escalate privileges on the machine or be used as a...
CVE-2023-28323
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS Operating System vulnerabilities to escalate privileges on the machine or be used as a...
CVE-2023-28323
CVE-2023-28323 affects Ivanti Endpoint Manager (EPM) versions prior to 2022 SU3, via a deserialization of untrusted data that allows an unauthenticated user to escalate privileges. The described impact is unauthenticated remote privilege escalation, potentially enabling escalation alongside other...
PT-2023-21648 · Ivanti · Ivanti Epm
Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 Su3 Description: A deserialization of untrusted data exists that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS vulnerabilities to escala...
Ivanti EPM Agent Portal Command Execution
This module leverages an unauthenticated RCE in Ivanti's EPM Agent Portal where a RPC client can invoke a method which will run an attacker-specified string on the remote target as NT AUTHORITY\SYSTEM. This vulnerability is present in versions prior to EPM 2021.1 Su4 and EPM 2022 Su2. Module...