Ivanti

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-22052 1Ivanti 2Connect Secure Policy Secure Jun 17, 2026 Apr 4, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the...Show more A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack Show less
CVE-2024-22023 1Ivanti 2Connect Secure Policy Secure Jun 17, 2026 Apr 4, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporari...Show more An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS. Show less
CVE-2023-46808 1Ivanti 1Neurons For Itsm Jun 17, 2026 Mar 31, 2024 N/A· v4 9.9 CRITICAL· v3 N/A· v2 An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root us...Show more An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user. Show less
CVE-2023-41724 1Ivanti 1Standalone Sentry Jun 17, 2026 Mar 31, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical...Show more A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. Show less
CVE-2024-22024 1Ivanti 3Connect Secure Policy SecureZero Trust Access Gateway Jun 17, 2026 Feb 13, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources wi...Show more An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.Show less
CVE-2024-21893 1Ivanti 3Connect Secure Neurons For Zero Trust AccessPolicy Secure Aug 4, 2026 Jan 31, 2024 N/A· v4 8.2 HIGH· v3 N/A· v2 A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resou...Show more A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.Show less
CVE-2024-21888 1Ivanti 2Connect Secure Policy Secure Jun 17, 2026 Jan 31, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
CVE-2023-41474 1Ivanti 1Avalanche Jun 17, 2026 Jan 25, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component.
CVE-2024-21887 1Ivanti 2Connect Secure Policy Secure Aug 4, 2026 Jan 12, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrar...Show more A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.Show less
CVE-2023-46805 1Ivanti 2Connect Secure Policy Secure Oct 1, 2026 Jan 12, 2024 N/A· v4 8.2 HIGH· v3 N/A· v2 An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-39336 1Ivanti 1Endpoint Manager Jun 17, 2026 Jan 9, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the n...Show more An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server. Show less
CVE-2023-46804 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVE-2023-46803 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVE-2023-46266 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
CVE-2023-46265 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
CVE-2023-46264 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
CVE-2023-46263 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.
CVE-2023-46262 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.
CVE-2023-46261 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVE-2023-46260 1Ivanti 1Avalanche Jun 17, 2026 Dec 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.

Previous 1...151617...26 Next