Ivanti Endpoint Manager vulnerabilities, page 4
116 vulnerabilities
Known vulnerabilities in Ivanti Endpoint Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-29847ivantiendpoint_manager+1
EPSS score52.91%
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.CVE-2024-29829ivantiendpoint_manager+1EPSS score8.23%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-29825ivantiendpoint_manager+1EPSS score99.88%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29827ivantiendpoint_manager+1EPSS score71.69%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29826ivantiendpoint_manager+1EPSS score99.88%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29824ivantiendpoint_manager+1KEVEPSS score99.94%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29830ivantiendpoint_manager+1EPSS score8.48%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-29846ivantiendpoint_manager+1EPSS score8.48%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-22058ivantiendpoint_manager+1EPSS score0.38%
A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older.CVE-2024-10256ivantiendpoint_manager+5EPSS score0.21%
Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.CVE-2024-10811ivantiendpoint_managerEPSS score3.52%
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.CVE-2024-32848ivantiendpoint_manager+1EPSS score43.36%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32841ivantiendpoint_manager+1EPSS score3.40%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32847ivantiendpoint_manager+1EPSS score3.16%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32846ivantiendpoint_manager+1EPSS score2.15%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32842ivantiendpoint_manager+1EPSS score2.15%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32840ivantiendpoint_manager+1EPSS score25.39%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32844ivantiendpoint_manager+1EPSS score1.71%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32839ivantiendpoint_manager+1EPSS score3.40%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32845ivantiendpoint_manager+1EPSS score24.01%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.