288 matches found
Avalanche 6.4.2 Security Hardening and CVEs addressed
Last Modified Date Aug 24, 2026 12:31:46 AM...
Security patch release - Ivanti Connect Secure 22.6R2 and 22.6R2.1
Last Modified Date Apr 18, 2024 5:20:53 PM...
Security Patch Release - Ivanti Policy Secure 22.6R1
Last Modified Date Aug 23, 2026 9:54:42 PM...
KB Possible Remote Exploit in ApacheMQ pertaining to OpenWire Module
Created Date Nov 13, 2023 7:08:12 PM...
Security fixes included in the latest Ivanti Secure Access Client Release
Last Modified Date Nov 16, 2023 2:01:28 PM...
CVE-2023-39335 - Certificate creation authentication bypass in UPDATEPROFILE handler
Created Date Nov 9, 2023 4:55:50 PM...
CVE-2023-39337 - MobileConfig profile download authentication bypass
Created Date Nov 9, 2023 4:55:41 PM...
CVE-2023-39338 - Authenticated user access protected Sentry service vulnerability
Created Date Nov 9, 2023 4:55:32 PM...
CVE-2023-38041 New client side release to address a privilege escalation on Windows user machines
Summary A vulnerability exists on all versions of the Ivanti Secure Access Client Below 22.6R1 that would allow an unprivileged local user to gain unauthorized elevated privileges on the affected system. Mitigation Currently None Resoluiton To resolve the below mentioned vulnerability upgrade you...
SA-2023-08-08-CVE-2023-35084
SECURITY ADVISORY 08-08-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-35084 Full details. Please log into the...
SA-2023-08-08-CVE-2023-35083
SECURITY ADVISORY 08-08-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-35083 Full details. Please log into the...
Samsung Email app security patch for CWE-297
Created Date Sep 15, 2023 7:06:21 AM...
Security Advisory - Avalanche CVE-2023-38036
Last Modified Date Mar 8, 2024 4:49:43 PM...
KB API Authentication Bypass on Sentry Administrator Interface - CVE-2023-38035
Last Modified Date Sep 5, 2023 9:01:44 AM...
CVE-2023-38035 – API Authentication Bypass on Sentry Administrator Interface
Last Modified Date Aug 23, 2026 11:52:15 PM...
Sentry : Database Open Access Vulnerability
Created Date Aug 14, 2023 2:57:34 PM...
Avalanche Vulnerabilities Addressed in 6.4.1
Securtiy Advisory for Avalanche 6.4 and older. To resolve these vulnerabilities, please upgrade to Avalanche 6.4.1.207 Download Page: https://www.wavelink.com/Download-AvalancheMobile-Device-Management-Software/ Release Notes:...
CVE-2023-35082 – Remote Unauthenticated API Access Vulnerability
DESCRIPTION: Update: Since originally reporting CVE-2023-35082 on 2 August 2023 at 10:00 MDT, Ivanti has continued its investigation and has found that this vulnerability impacts all versions of Ivanti Endpoint Manager Mobile EPMM 11.10, 11.9 and 11.8 and MobileIron Core 11.7 and below. The risk ...
CVE-2023-35081 - Remote Arbitrary File Write
Last Modified Date Aug 3, 2023 2:34:52 PM...
SA-2023-07-26-CVE-2023-28129
SECURITY ADVISORY 07-26-2023 Product Affected: Ivanti Desktop and Server Management A vulnerability was recently discovered in DSM 2022.1 Service Update 1. This vulnerability is remediated in DSM 2022.2 Service Update 3. Vulnerability Information CVE | CVSS | Summary | Product Affected...
CVE-2023-35078 - Remote Unauthenticated API Access Vulnerability
Last Modified Date Sep 29, 2023 7:08:14 PM...
SA-2023-07-19-CVE-2023-35077
SECURITY ADVISORY 07-19-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for Ivanti Antivirus Security Content version 7.94791 and all previous versions. Updating to Ivanti Antivirus Product version 7.9.1.285 will allow the Security Content version to update ...
CVE (2023-34298) Ivanti Secure Access Client Local Privilege Escalation
Summary A logged in Windows user can leverage functionality of the Pulse Secure / Ivanti Secure Access Client or Pulse Secure Installer Service to carry out a privilege escalation on the user machine. Mitigation None Currently Related Links https://forums.ivanti.com/s/article/New-Client-Side...
SA-2023-06-20-CVE-2023-28323
SECURITY ADVISORY 06-20-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-28323 Full details . Please log into the...
SA-2023-06-06-CVE-2023-28324
SECURITY ADVISORY 06-06-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for Ivanti Endpoint Manager for all versions of 2022 SU2 and below. Please patch to the latest version of EPM 2022. If you are using 2021.1, please patch to SU4 and apply the hotfix as...
ZDI-CAN-17750: Ivanti Avalanche EnterpriseServer GetSettings Exposed Dangerous Method Authentication Bypass Vulnerability
This vulnerability allows to bypass the patches for following vulnerabilities: ZDI-CAN-15251 ZDI-CAN-15137 ZDI-CAN-15528 ZDI-CAN-15919 Those patches restricted an access to the messages or validated the response through the calculation of the h.meta1 token. However, the attacker is able to leak t...
ZDI-CAN-17769 Ivanti Avalanche getLogFile Directory Traversal Information Disclosure
This advisory presents a bypass for the ZDI-CAN-15967 Path Traversal leading to Arbitrary File Read patch. getLogFile method verifies the UUID input parameter. However, it does not verify the provided fileName path. According to that, the attacker can still exploit this issue and retrieve files...
ZDI-CAN-17812: Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability
This vulnerability presents a bypass for the ZDI-CAN-14187 vulnerability patch Arbitrary File Upload leading to Remote Code Execution. Blacklist of the forbidden directories can be bypassed with the 8.3 filenames. Instead of the "Program Files" directory, the attacker may use "PROGRA1". .jsp...
ZDI-CAN-17729 - CVE-2023-28125 - Bug 958437: ZDI-CAN-17729: Ivanti Avalanche InfoRail Authentication Bypass Vulnerability
Last Modified Date 2024-3-8 16:51:05...
Avalanche ZDI-CAN-19513 Security Advisory
Last Modified Date Apr 3, 2023 8:41:48 PM...
CSA 上的 HSTS 安全漏洞
Created Date Mar 7, 2023 1:38:55 AM...
JSA10571 - 2013-06 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Internal and test Certificate Authority Root Servers unintentionally added to Trusted CA list
Last Modified Date Aug 24, 2026 12:34:46 AM...
JSA10553 - 2013-03: Security Bulletin: Pulse Secure Mobile: Android client privilege escalation
Last Modified Date Aug 24, 2026 12:34:47 AM...
JSA10469 - Pre-authentication CGI script prints arbitrary contents of XML and ZIP files
Last Modified Date Aug 24, 2026 12:34:50 AM...
JSA10502 - 2012-03 Security Bulletin: Pulse Connect Secure (PCS): Cross Site Scripting Issue
Last Modified Date Mar 4, 2024 4:59:29 PM...
JSA10591 - 2013-09 Security Bulletin: Pulse Connect Secure and Pulse Policy Secure: Multiple OpenSSL vulnerabilities
Last Modified Date Aug 24, 2026 12:34:45 AM...
JSA10544 - 2012-11 Security Bulletin: Steel-Belted Radius: Multiple OpenSSL Vulnerabilities
Last Modified Date Mar 10, 2023 8:08:33 AM...
JSA10462 - Cross-site scripting issue with file browsing upload page
Last Modified Date Aug 24, 2026 2:17:07 AM...
JSA10453 - 2010-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Local Client Logging Issue
Last Modified Date Aug 24, 2026 12:34:57 AM...
JSA10350 - Optimistic TCP acknowledgements can cause denial of service (CERT/CC VU#102014)
Last Modified Date Aug 24, 2026 12:35:35 AM...
JSA10590 - 2013-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Crafted packet can cause denial of service
Last Modified Date Aug 24, 2026 12:34:46 AM...
JSA10471 - Out of Cycle Security Bulletin: Pulse Connect Secure (PCS) Network Connect Credential Provider Issue
Last Modified Date Aug 24, 2026 12:35:29 AM...
JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash
Last Modified Date Aug 24, 2026 12:34:43 AM...
JSA10628 - 2014-06 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Weak SSL cipher allowed unexpectedly when higher level cipher group is configured (CVE-2014-3812)
Last Modified Date Aug 24, 2026 12:34:44 AM...
JSA10536 - 2012-09 Security Bulletin: Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS): Specifically crafted https packet may cause denial of service
Last Modified Date Aug 24, 2026 12:34:47 AM...
JSA10445 - 2010-06 Security Bulletin: Pulse Connect Secure (PCS) Cross Site Scripting Issue in Windows Secure Application Manager
Last Modified Date Aug 24, 2026 12:34:51 AM...
JSA10470 - Pre-authentication CGI script fails to fully validate all parameters
Last Modified Date Aug 24, 2026 12:34:50 AM...
JSA10402 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - Multiple Web-based CGI and Cross Site Scripting (XSS) vulnerabilities.
Last Modified Date Aug 24, 2026 12:34:58 AM...