Summary
Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, einen Denial-of-Service Zustand zu erzeugen und Daten zu modifizieren
Product
Connect Secure bietet TLS- und mobile VPN-Lösungen.
Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung.
Der Ivanti Secure Access Client ist ein VPN Client für Ivanti Connect Secure.
Vulnerabilities 27
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before versio…
-
Critical 9.1
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1CVE-2024-47908 EPSS 22%
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker…
-
High 8.8
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version …
-
High 7.8
Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate …
-
High 7.8
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy S…
-
High 7.8
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Polic…
-
High 7.8
Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate th…
-
High 7.5
An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trig…
-
High 7.5
An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remo…
-
High 7.5
A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated…
-
High 7.5
A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.…
-
High 7.3
Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to cre…
-
High 7.1
A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify s…
-
High 7.1
Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to mo…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows …
-
Medium 5.0
A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a deni…
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 4.4
Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker wit…
Revision history
-
#1
Initiale Fassung
References
-
Ivanti Security Advisory Ivanti Connect Secure vom 2024-11-12
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US