← Back

Ivanti

ivanti

492 CVEs • 41 products

Products (41)

Click to collapse
Toggle
Connect Secure
connect_secure
130 CVEs
Avalanche
avalanche
117 CVEs
Endpoint Manager
endpoint_manager
116 CVEs
Policy Secure
policy_secure
77 CVEs
Endpoint Manager Mobile
endpoint_manager_mobile
28 CVEs
Workspace Control
workspace_control
22 CVEs
Secure Access Client
secure_access_client
21 CVEs
Zero Trust Access Gateway
zero_trust_access_gateway
17 CVEs
Neurons For Secure Access
neurons_for_secure_access
15 CVEs
Cloud Services Appliance
cloud_services_appliance
7 CVEs
Landesk Management Suite
landesk_management_suite
6 CVEs
Desktop & Server Management
desktop_&_server_management
6 CVEs
Neurons For Itsm
neurons_for_itsm
6 CVEs
Endpoint Manager Cloud Services Appliance
endpoint_manager_cloud_services_appliance
5 CVEs
Neurons For Zero Trust Access
neurons_for_zero-trust_access
5 CVEs
Standalone Sentry
standalone_sentry
4 CVEs
Incapptic Connect
incapptic_connect
3 CVEs
Security Controls
security_controls
3 CVEs
Mobileiron
mobileiron
2 CVEs
Automation
automation
2 CVEs
Application Control
application_control
2 CVEs
Virtual Traffic Manager
virtual_traffic_manager
2 CVEs
Endpoint Security
endpoint_security
1 CVE
Desktop&server Management
desktop&server_management
1 CVE
Service Manager Heat Remote Control
service_manager_heat_remote_control
1 CVE
Dsm Netinst
dsm_netinst
1 CVE
Service Manager
service_manager
1 CVE
Dsm Remote
dsm_remote
1 CVE
Mobileiron Sentry
mobileiron_sentry
1 CVE
Pulse Secure Desktop Client
pulse_secure_desktop_client
1 CVE
Pulse Secure Installer Service
pulse_secure_installer_service
1 CVE
Docs@work
docs@work
1 CVE
Virtual Traffic Management
virtual_traffic_management
1 CVE
Velocity License Server
velocity_license_server
1 CVE
Neurons Agent Platform
neurons_agent_platform
1 CVE
Neurons For Patch Management
neurons_for_patch_management
1 CVE
Patch For Configuration Manager
patch_for_configuration_manager
1 CVE
Patch Software Development Kit
patch_software_development_kit
1 CVE
Performance Manager
performance_manager
1 CVE
Virtual Application Delivery Controller
virtual_application_delivery_controller
1 CVE
Xtraction
xtraction
1 CVE

CVEs (492)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-42124
1Ivanti
1Avalanche
Jun 17, 2026
Dec 7, 2021
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.
CVE-2021-22965
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Nov 19, 2021
N/A· v4
7.5 HIGH· v3
7.8 HIGH· v2
A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device.
CVE-2021-36235
1Ivanti
1Workspace Control
Jun 17, 2026
Sep 1, 2021
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the atta...Show more
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.Show less
CVE-2021-22938
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.
CVE-2021-22937
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.
CVE-2021-22936
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.
CVE-2021-22935
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.
CVE-2021-22934
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious cr...Show more
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.Show less
CVE-2021-22933
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
Aug 16, 2021
N/A· v4
6.5 MEDIUM· v3
5.5 MEDIUM· v2
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.
CVE-2021-3540
1Ivanti
1Mobileiron
Jun 17, 2026
Jul 22, 2021
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
CVE-2021-3198
1Ivanti
1Mobileiron
Jun 17, 2026
Jul 22, 2021
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
CVE-2021-22908
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
May 27, 2021
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, thi...Show more
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.Show less
CVE-2021-22900
2Ivanti
Pulsesecure
2Connect Secure
Pulse Connect Secure
Jun 17, 2026
May 27, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the admi...Show more
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.Show less
CVE-2021-22899
1Ivanti
1Connect Secure
Jun 17, 2026
May 27, 2021
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
CVE-2021-22894
1Ivanti
1Connect Secure
Jun 17, 2026
May 27, 2021
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
CVE-2021-22893
1Ivanti
1Connect Secure
Jun 17, 2026
Apr 23, 2021
N/A· v4
10.0 CRITICAL· v3
7.5 HIGH· v2
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow...Show more
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.Show less
CVE-2020-13773
1Ivanti
1Endpoint Manager
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_f...Show more
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_findfrm.aspx, /LDMS/frm_taskfrm.aspx, and /LDMS/query_browsecomp.aspx.Show less
CVE-2020-13772
1Ivanti
1Endpoint Manager
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication requir...Show more
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required.Show less
CVE-2020-13769
1Ivanti
1Endpoint Manager
Jun 17, 2026
Nov 16, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.
CVE-2020-13774
1Ivanti
1Endpoint Manager
Jun 17, 2026
Nov 12, 2020
N/A· v4
9.9 CRITICAL· v3
9.0 HIGH· v2
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is c...Show more
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image, which upon failure will leave the temporarily created files in an accessible location on the server.Show less