Filtered by vendor Ivanti Subscriptions

Search

Switch to Advanced Search (Beta)
Total 431 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-4791 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2025-04-12 N/A
The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.
CVE-2016-4788 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2025-04-12 N/A
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.
CVE-2016-4787 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2025-04-12 N/A
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
CVE-2016-4789 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2025-04-12 N/A
Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4786 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2025-04-12 N/A
Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVE-2024-11004 1 Ivanti 2 Connect Secure, Policy Secure 2025-04-04 6.1 Medium
Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
CVE-2024-37403 1 Ivanti 1 Docs\@work 2025-03-25 5.5 Medium
Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.
CVE-2023-41724 1 Ivanti 2 Sentry, Standalone Sentry 2025-03-25 8.8 High
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
CVE-2024-36132 1 Ivanti 1 Endpoint Manager Mobile 2025-03-19 7.5 High
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources.
CVE-2024-36130 1 Ivanti 1 Endpoint Manager Mobile 2025-03-13 9.8 Critical
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
CVE-2024-37398 1 Ivanti 1 Secure Access Client 2025-03-13 7.8 High
Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
CVE-2024-22026 1 Ivanti 1 Endpoint Manager Mobile 2025-03-13 6.7 Medium
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.
CVE-2024-9420 1 Ivanti 2 Connect Secure, Policy Secure 2025-03-13 8.8 High
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution
CVE-2023-38041 2 Ivanti, Microsoft 2 Secure Access Client, Windows 2025-03-07 7.0 High
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
CVE-2023-32562 1 Ivanti 1 Avalanche 2025-03-06 9.8 Critical
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.
CVE-2023-32561 1 Ivanti 1 Avalanche 2025-03-06 7.5 High
A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
CVE-2023-32560 1 Ivanti 1 Avalanche 2025-03-06 9.8 Critical
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.
CVE-2022-44574 1 Ivanti 1 Avalanche 2025-02-28 7.5 High
An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.
CVE-2024-47908 1 Ivanti 1 Cloud Services Appliance 2025-02-20 9.1 Critical
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-13813 1 Ivanti 1 Secure Access Client 2025-02-20 7.1 High
Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files.