Vendor
ivanti
413 known vulnerabilities.
Products
Avalanche 92
Endpoint Manager 73
Connect Secure 65
Policy Secure 52
EPM 33
Endpoint Manager Mobile 25
Secure Access Client 15
ZTA Gateway 15
Neurons for Secure Access 13
EPMM 11
Workspace Control 10
Sentry 10
Xtraction 8
CSA (Cloud Services Appliance) 6
Cloud Services Application 6
Neurons for ITSM 5
ICS 5
IPS 5
ITSM 5
Wavelink 4
Neurons for ZTA gateways 3
DSM 3
Ivanti Neurons for ITSM 3
Neurons for ITSM (Cloud) 3
MobileIron Core 2
Ivanti Endpoint Manager 2
Neurons for ITSM (On-Premise) 2
Secure Access Client Windows 2
Desktop and Server Management 2
Secure Access Linux 2
Security Controls 2
Neurons for Secure 2
Automation 2
Docs@Work 1
LANDesk Management Suite 1
Connect Secure 22.7R2.9 1
Patch SDK 1
Patch for Configuration Manager 1
Neurons for Patch Management 1
Neurons Agent Platform 1
92 results · Clear filters · Feed
-
Medium 4.9
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can pe…
-
Medium 6.8
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized…
-
Medium 5.5
SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote …
-
Medium 6.6
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows…
-
Medium 6.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local auth…
-
Medium 5.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy S…
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version …
-
Medium 6.3
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Iv…
-
Medium 5.3
Authentication Bypass
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
KEV May 19, 2025 -
Medium 5.8
A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php t…
-
Medium 6.1
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthentic…
-
Medium 6.1
An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 202…
-
Medium 4.8
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a …
-
Medium 6.0
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versi…
-
Medium 6.0
A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allow…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows …
-
Medium 6.8
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versio…
-
Medium 5.3
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functio…
-
Medium 4.4
Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker wit…
-
Medium 5.0
A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a deni…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 6.5
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with a…
KEV Oct 9, 2024 -
Medium 6.7
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local aut…
-
Medium 4.3
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote aut…
-
Medium 5.8
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
-
Medium 5.3
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
-
Medium 5.3
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to a…
-
Medium 5.0
Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to p…
-
Medium 6.7
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate p…
-
Medium 6.7
An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with ap…
-
Medium 6.7CVE-2024-22026 Public exploit
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell r…
-
Medium 5.3
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…
-
Medium 5.3
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…
-
Medium 5.3
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…
-
Medium 5.3
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…
-
Medium 6.5
A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an aut…
-
Medium 6.5
A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an aut…
-
Medium 4.3
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…