← Back

Ivanti

ivanti

504 CVEs • 41 products

Products (41)

Click to collapse
Toggle
Connect Secure
connect_secure
131 CVEs
Avalanche
avalanche
117 CVEs
Endpoint Manager
endpoint_manager
116 CVEs
Policy Secure
policy_secure
77 CVEs
Endpoint Manager Mobile
endpoint_manager_mobile
29 CVEs
Workspace Control
workspace_control
22 CVEs
Secure Access Client
secure_access_client
21 CVEs
Zero Trust Access Gateway
zero_trust_access_gateway
17 CVEs
Neurons For Secure Access
neurons_for_secure_access
15 CVEs
Neurons For Itsm
neurons_for_itsm
14 CVEs
Cloud Services Appliance
cloud_services_appliance
7 CVEs
Landesk Management Suite
landesk_management_suite
6 CVEs
Desktop & Server Management
desktop_&_server_management
6 CVEs
Endpoint Manager Cloud Services Appliance
endpoint_manager_cloud_services_appliance
5 CVEs
Neurons For Zero Trust Access
neurons_for_zero-trust_access
5 CVEs
Standalone Sentry
standalone_sentry
4 CVEs
Incapptic Connect
incapptic_connect
3 CVEs
Security Controls
security_controls
3 CVEs
Xtraction
xtraction
3 CVEs
Mobileiron
mobileiron
2 CVEs
Automation
automation
2 CVEs
Application Control
application_control
2 CVEs
Virtual Traffic Manager
virtual_traffic_manager
2 CVEs
Endpoint Security
endpoint_security
1 CVE
Desktop&server Management
desktop&server_management
1 CVE
Service Manager Heat Remote Control
service_manager_heat_remote_control
1 CVE
Dsm Netinst
dsm_netinst
1 CVE
Service Manager
service_manager
1 CVE
Dsm Remote
dsm_remote
1 CVE
Mobileiron Sentry
mobileiron_sentry
1 CVE
Pulse Secure Desktop Client
pulse_secure_desktop_client
1 CVE
Pulse Secure Installer Service
pulse_secure_installer_service
1 CVE
Docs@work
docs@work
1 CVE
Virtual Traffic Management
virtual_traffic_management
1 CVE
Velocity License Server
velocity_license_server
1 CVE
Neurons Agent Platform
neurons_agent_platform
1 CVE
Neurons For Patch Management
neurons_for_patch_management
1 CVE
Patch For Configuration Manager
patch_for_configuration_manager
1 CVE
Patch Software Development Kit
patch_software_development_kit
1 CVE
Performance Manager
performance_manager
1 CVE
Virtual Application Delivery Controller
virtual_application_delivery_controller
1 CVE

CVEs (504)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-10242
1Ivanti
1Endpoint Manager Mobile
Oct 8, 2026
Oct 14, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2025-62392
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62391
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62390
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62389
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62388
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62387
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62386
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62385
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62384
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-62383
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-11623
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
CVE-2025-9713
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVE-2025-11622
1Ivanti
1Endpoint Manager
Oct 8, 2026
Oct 13, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
CVE-2025-9872
1Ivanti
1Endpoint Manager
Sep 26, 2026
Sep 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVE-2025-9712
1Ivanti
1Endpoint Manager
Jun 17, 2026
Sep 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVE-2025-8712
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.Show less
CVE-2025-8711
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo...Show more
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.Show less
CVE-2025-55148
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
7.6 HIGH· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.Show less
CVE-2025-55147
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo...Show more
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is requiredShow less