Ivanti

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-13771 1Ivanti 1Endpoint Manager Jun 17, 2026 Nov 12, 2020 N/A· v4 7.8 HIGH· v3 6.9 MEDIUM· v2 Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of priv...Show more Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of privileges to the level of privilege held by the vulnerable component such as NT AUTHORITY\SYSTEM) via DLL hijacking. This affects ldiscn32.exe, IpmiRedirectionService.exe, LDAPWhoAmI.exe, and ldprofile.exe.Show less
CVE-2020-13770 1Ivanti 1Endpoint Manager Jun 17, 2026 Nov 12, 2020 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to...Show more Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having SeImpersonatePrivilege (eg. user ‘NT AUTHORITY\NETWORK SERVICE’).Show less
CVE-2020-8262 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.
CVE-2020-8261 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Oct 28, 2020 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
CVE-2020-8260 1Ivanti 1Connect Secure Jun 17, 2026 Oct 28, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.
CVE-2020-15352 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Oct 27, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks vi...Show more An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.Show less
CVE-2020-8256 2Ivanti Pulsesecure 2Connect Secure Pulse Connect Secure Jun 17, 2026 Sep 30, 2020 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerabilit...Show more A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.Show less
CVE-2020-8243 1Ivanti 2Connect Secure Policy Secure Jun 17, 2026 Sep 30, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVE-2020-8238 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).
CVE-2020-13793 1Ivanti 1Dsm Netinst Jun 17, 2026 Aug 6, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.
CVE-2020-12441 1Ivanti 2Desktop&server Management Service Manager Heat Remote Control Jun 17, 2026 Aug 6, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network...Show more Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The DoS can be triggered by sending a specially crafted network packet.Show less
CVE-2020-8222 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 6.8 MEDIUM· v3 4.0 MEDIUM· v2 A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.
CVE-2020-8221 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.
CVE-2020-8220 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS.
CVE-2020-8219 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 7.2 HIGH· v3 4.0 MEDIUM· v2 An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.
CVE-2020-8218 2Ivanti Pulsesecure 3Connect Secure Policy SecurePulse Policy Secure Jun 17, 2026 Jul 30, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2020-8217 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.
CVE-2020-8216 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID.
CVE-2020-8206 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.
CVE-2020-8204 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Jul 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.

Previous 1...212223 24 25 Next