CVE-2024-5564

CVE-2024-5564 affects libndp, a library used by NetworkManager to handle IPv6 Neighbor Discovery. The issue is a buffer overflow triggered by a malformed IPv6 router advertisement due to improper validation of route length information, allowing a local attacker with user privileges to exploit the...

CVE-2024-29823

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...

CVE-2024-29824

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...

CVE-2024-29825

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...

CVE-2023-38551

A CRLF Injection vulnerability in Ivanti Connect Secure 9.x, 22.x allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack...

CVE-2021-44534

Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure...

CVE-2024-31030

CVE-2024-31030 affects FreeCoAP v0.7 (Keith Cullen) with a bug in coap_msg.c that allows remote attackers to cause a Denial of Service or disclose information via a specially crafted CoAP packet. Connected sources consistently describe the issue but do not provide a public patch or fixed version ...

CVE-2021-44534

Technical details are not publicly available in the provided documents. The materials reiterate that insufficient input filtering can lead to arbitrary file read and data disclosure; monitor for updates for concrete remediation or affected products.

CVE-2024-29828

Ivanti Endpoint Manager (EPM) Core server is affected by CVE-2024-29828: an unspecified SQL Injection in EPM 2022 SU5 and earlier, allowing an authenticated attacker on the same network to execute arbitrary code. Connected sources confirm remediation via May 2024 security updates/hotfixes from Iv...

CVE-2023-38551

CVE-2023-38551 affects Ivanti Connect Secure (9.x, 22.x). A CRLF injection vulnerability allows an authenticated high-privileged user to inject code into a victim’s browser, enabling cross-site scripting (XSS). Impact: attacker can cause client-side script execution; CVSS ~8.2 (HIGH). Remediation...

CVE-2023-38042

CVE-2023-38042; Ivanti Secure Access Client for Windows suffers a local privilege escalation (low privilege user becomes SYSTEM). Root cause described in PT-2024-4024 as a memory buffer overflow; other sources corroborate LPE on Windows. No patch/version details are provided in the supplied docum...

CVE-2024-29822

CVE-2024-29822 is an unspecified SQL Injection affecting Ivanti Endpoint Manager (EPM) Core server in 2022 SU5 and earlier. The vulnerability allows an unauthenticated attacker on the same network to execute arbitrary code. Several connected sources corroborate an Ivanti EPM SQL Injection issue w...

CVE-2023-46810

Ivanti CVE-2023-46810 affects the Ivanti Secure Access Client for Linux prior to 22.7R1. The issue is a local privilege escalation (low-privileged user to root) tied to a buffer overflow in the Linux client component. Impact is local, with root-equivalent code execution possible if exploited. Rem...

CVE-2024-29829

CVE-2024-29829 is an SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The issue allows an authenticated attacker on the same network to execute arbitrary code due to an unspecified SQL injection in the Core server. Multiple sources corroborate ...

CVE-2024-29848

Ivanti Avalanche has a validated vulnerability CVE-2024-29848: an unrestricted file upload in the Avalanche web component before 6.4.x can be exploited by an authenticated, privileged user to execute arbitrary commands as SYSTEM. Multiple sources (Red Hat, NVD/NIST, Nessus plugin, and Ivanti advi...

CVE-2024-29846

CVE-2024-29846 is a SQL Injection in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The vulnerability enables an authenticated attacker on the same network to execute arbitrary code via the server, per the NVD description. Connected sources corroborate this as an Ivanti EP...

CVE-2024-29830

Summary: CVE-2024-29830 is an SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The advisory indicates an authenticated attacker on the same network can execute arbitrary code. The vulnerability is categorized with a high impact (C/H for confide...

CVE-2024-22060

CVE-2024-22060 affects Ivanti Neurons for ITSM, specifically the web component. The vulnerability is an unrestricted file upload that, when exploited by a remote, authenticated, high-privileged user, enables writing arbitrary files into sensitive directories on the ITSM server. The root cause is ...

CVE-2024-22058

Ivanti Endpoint Manager (EPM) versions 2021.1 and older are affected by a local buffer overflow vulnerability. A low-privilege user who has the EPM Agent installed on the local machine can potentially execute arbitrary code with elevated permissions. The public documents consistently describe the...

CVE-2024-29826

CVE-2024-29826 is an unspecified SQL Injection in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The vulnerability allows an unauthenticated attacker on the same network to execute arbitrary code. Affected component: Core server SQL logic. Impact: remote code execution wit...