← Back

Ivanti

ivanti

504 CVEs • 41 products

Products (41)

Click to collapse
Toggle
Connect Secure
connect_secure
131 CVEs
Avalanche
avalanche
117 CVEs
Endpoint Manager
endpoint_manager
116 CVEs
Policy Secure
policy_secure
77 CVEs
Endpoint Manager Mobile
endpoint_manager_mobile
29 CVEs
Workspace Control
workspace_control
22 CVEs
Secure Access Client
secure_access_client
21 CVEs
Zero Trust Access Gateway
zero_trust_access_gateway
17 CVEs
Neurons For Secure Access
neurons_for_secure_access
15 CVEs
Neurons For Itsm
neurons_for_itsm
14 CVEs
Cloud Services Appliance
cloud_services_appliance
7 CVEs
Landesk Management Suite
landesk_management_suite
6 CVEs
Desktop & Server Management
desktop_&_server_management
6 CVEs
Endpoint Manager Cloud Services Appliance
endpoint_manager_cloud_services_appliance
5 CVEs
Neurons For Zero Trust Access
neurons_for_zero-trust_access
5 CVEs
Standalone Sentry
standalone_sentry
4 CVEs
Incapptic Connect
incapptic_connect
3 CVEs
Security Controls
security_controls
3 CVEs
Xtraction
xtraction
3 CVEs
Mobileiron
mobileiron
2 CVEs
Automation
automation
2 CVEs
Application Control
application_control
2 CVEs
Virtual Traffic Manager
virtual_traffic_manager
2 CVEs
Endpoint Security
endpoint_security
1 CVE
Desktop&server Management
desktop&server_management
1 CVE
Service Manager Heat Remote Control
service_manager_heat_remote_control
1 CVE
Dsm Netinst
dsm_netinst
1 CVE
Service Manager
service_manager
1 CVE
Dsm Remote
dsm_remote
1 CVE
Mobileiron Sentry
mobileiron_sentry
1 CVE
Pulse Secure Desktop Client
pulse_secure_desktop_client
1 CVE
Pulse Secure Installer Service
pulse_secure_installer_service
1 CVE
Docs@work
docs@work
1 CVE
Virtual Traffic Management
virtual_traffic_management
1 CVE
Velocity License Server
velocity_license_server
1 CVE
Neurons Agent Platform
neurons_agent_platform
1 CVE
Neurons For Patch Management
neurons_for_patch_management
1 CVE
Patch For Configuration Manager
patch_for_configuration_manager
1 CVE
Patch Software Development Kit
patch_software_development_kit
1 CVE
Performance Manager
performance_manager
1 CVE
Virtual Application Delivery Controller
virtual_application_delivery_controller
1 CVE

CVEs (504)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-55146
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed...Show more
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.Show less
CVE-2025-55145
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
8.9 HIGH· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.Show less
CVE-2025-55144
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.Show less
CVE-2025-55143
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed...Show more
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.Show less
CVE-2025-55142
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.Show less
CVE-2025-55141
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on...Show more
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.Show less
CVE-2025-55139
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Oct 18, 2026
Sep 9, 2025
N/A· v4
6.8 MEDIUM· v3
N/A· v2
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo...Show more
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.Show less
CVE-2025-8310
1Ivanti
1Virtual Application Delivery Controller
Jun 17, 2026
Aug 12, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password
CVE-2025-8297
1Ivanti
1Avalanche
Jun 17, 2026
Aug 12, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution
CVE-2025-8296
1Ivanti
1Avalanche
Jun 17, 2026
Aug 12, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code executio...Show more
SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code executionShow less
CVE-2025-5468
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Aug 12, 2025
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22....Show more
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.Show less
CVE-2025-5466
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Aug 12, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allo...Show more
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of serviceShow less
CVE-2025-5462
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Aug 12, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix depl...Show more
A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.Show less
CVE-2025-5456
1Ivanti
4Connect Secure
Neurons For Secure AccessPolicy Secure+1 more
Jun 17, 2026
Aug 12, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix d...Show more
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125Show less
CVE-2024-38648
1Ivanti
1Desktop & Server Management
Jun 17, 2026
Jul 12, 2025
N/A· v4
5.7 MEDIUM· v3
N/A· v2
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.
CVE-2023-39339
1Ivanti
1Policy Secure
Jun 17, 2026
Jul 12, 2025
N/A· v4
4.9 MEDIUM· v3
N/A· v2
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
CVE-2023-38036
1Ivanti
1Avalanche
Jun 17, 2026
Jul 12, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.
CVE-2025-6771
1Ivanti
1Endpoint Manager Mobile
Jun 17, 2026
Jul 8, 2025
N/A· v4
7.2 HIGH· v3
N/A· v2
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution
CVE-2025-5464
1Ivanti
1Connect Secure
Jun 17, 2026
Jul 8, 2025
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information.
CVE-2025-0293
1Ivanti
2Connect Secure
Policy Secure
Jun 17, 2026
Jul 8, 2025
N/A· v4
2.7 LOW· v3
N/A· v2
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk...Show more
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.Show less