CVE-2024-31030

CVE-2024-31030 affects FreeCoAP v0.7 (Keith Cullen) with a bug in coap_msg.c that allows remote attackers to cause a Denial of Service or disclose information via a specially crafted CoAP packet. Connected sources consistently describe the issue but do not provide a public patch or fixed version ...

CVE-2021-44534

Technical details are not publicly available in the provided documents. The materials reiterate that insufficient input filtering can lead to arbitrary file read and data disclosure; monitor for updates for concrete remediation or affected products.

CVE-2024-22058

Ivanti Endpoint Manager (EPM) versions 2021.1 and older are affected by a local buffer overflow vulnerability. A low-privilege user who has the EPM Agent installed on the local machine can potentially execute arbitrary code with elevated permissions. The public documents consistently describe the...

CVE-2024-29829

CVE-2024-29829 is an SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The issue allows an authenticated attacker on the same network to execute arbitrary code due to an unspecified SQL injection in the Core server. Multiple sources corroborate ...

CVE-2024-29830

Summary: CVE-2024-29830 is an SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The advisory indicates an authenticated attacker on the same network can execute arbitrary code. The vulnerability is categorized with a high impact (C/H for confide...

CVE-2023-46810

Ivanti CVE-2023-46810 affects the Ivanti Secure Access Client for Linux prior to 22.7R1. The issue is a local privilege escalation (low-privileged user to root) tied to a buffer overflow in the Linux client component. Impact is local, with root-equivalent code execution possible if exploited. Rem...

CVE-2024-29824

CVE-2024-29824 affects Ivanti Endpoint Manager (EPM) Core server. A SQL injection in the RecordGoodApp flow (via un-sanitized md5 in ReportedGoodApps handling) allows an unauthenticated attacker on the same network to execute arbitrary code, enabling unauthenticated remote code execution. Vulnera...

CVE-2023-38551

CVE-2023-38551 affects Ivanti Connect Secure (9.x, 22.x). A CRLF injection vulnerability allows an authenticated high-privileged user to inject code into a victim’s browser, enabling cross-site scripting (XSS). Impact: attacker can cause client-side script execution; CVSS ~8.2 (HIGH). Remediation...

CVE-2024-29827

CVE-2024-29827 is an SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. An unauthenticated, adjacent-network attacker can execute arbitrary code due to improper input handling in the Core server (PTSecurity notes involve the GetDBPatchProducts fu...

CVE-2024-29828

Ivanti Endpoint Manager (EPM) Core server is affected by CVE-2024-29828: an unspecified SQL Injection in EPM 2022 SU5 and earlier, allowing an authenticated attacker on the same network to execute arbitrary code. Connected sources confirm remediation via May 2024 security updates/hotfixes from Iv...

CVE-2024-22060

CVE-2024-22060 affects Ivanti Neurons for ITSM, specifically the web component. The vulnerability is an unrestricted file upload that, when exploited by a remote, authenticated, high-privileged user, enables writing arbitrary files into sensitive directories on the ITSM server. The root cause is ...

CVE-2024-29823

CVE-2024-29823 is an unspecified SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (Ivanti EPM) 2022 SU5 and earlier. An unauthenticated attacker on the same network can execute arbitrary code. The cited sources consistently describe this as part of a broader set of SQL in...

CVE-2024-29826

CVE-2024-29826 is an unspecified SQL Injection in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The vulnerability allows an unauthenticated attacker on the same network to execute arbitrary code. Affected component: Core server SQL logic. Impact: remote code execution wit...

CVE-2024-29822

CVE-2024-29822 is an unspecified SQL Injection affecting Ivanti Endpoint Manager (EPM) Core server in 2022 SU5 and earlier. The vulnerability allows an unauthenticated attacker on the same network to execute arbitrary code. Several connected sources corroborate an Ivanti EPM SQL Injection issue w...

CVE-2024-29825

CVE-2024-29825 describes an unauthenticated SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior . The underlying issue allows an attacker on the same network to execute arbitrary code, with high impact to confidentiality, integrity, and availability ...

CVE-2024-29848

Ivanti Avalanche has a validated vulnerability CVE-2024-29848: an unrestricted file upload in the Avalanche web component before 6.4.x can be exploited by an authenticated, privileged user to execute arbitrary commands as SYSTEM. Multiple sources (Red Hat, NVD/NIST, Nessus plugin, and Ivanti advi...

CVE-2023-38042

CVE-2023-38042; Ivanti Secure Access Client for Windows suffers a local privilege escalation (low privilege user becomes SYSTEM). Root cause described in PT-2024-4024 as a memory buffer overflow; other sources corroborate LPE on Windows. No patch/version details are provided in the supplied docum...

CVE-2024-29846

CVE-2024-29846 is a SQL Injection in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The vulnerability enables an authenticated attacker on the same network to execute arbitrary code via the server, per the NVD description. Connected sources corroborate this as an Ivanti EP...

CVE-2024-22059

CVE-2024-22059 describes a SQL injection in the web component of Ivanti Neurons for ITSM. The vulnerability is exploitable by a remote authenticated user and can allow reading, modification, or deletion of information in the underlying database, with potential denial of service. Affected product:...

CVE-2024-5176

CVE-2024-5176 affects Baxter/ Welch Allyn Configuration Tool, version 1.9.4.1 and earlier. The underlying issue is insufficiently protected credentials , which could enable remote services to operate with stolen credentials. According to the sources, the vulnerability is rated with a high impact:...