Ivanti EPM vulnerabilities
33 vulnerabilities
Known vulnerabilities in Ivanti EPM, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-37381ivantiendpoint_manager+1
EPSS score3.14%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-37376ivantiendpoint_manager+1EPSS score3.16%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-37397ivantiendpoint_manager+1EPSS score59.26%
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.CVE-2024-29828ivantiendpoint_manager+1EPSS score8.48%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-29823ivantiendpoint_manager+1EPSS score99.86%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29822ivantiendpoint_manager+1EPSS score64.39%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29847ivantiendpoint_manager+1EPSS score52.91%
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.CVE-2024-29829ivantiendpoint_manager+1EPSS score8.23%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-29825ivantiendpoint_manager+1EPSS score99.88%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29827ivantiendpoint_manager+1EPSS score71.69%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29826ivantiendpoint_manager+1EPSS score99.88%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29824ivantiendpoint_manager+1KEVEPSS score99.94%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.CVE-2024-29830ivantiendpoint_manager+1EPSS score8.48%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-29846ivantiendpoint_manager+1EPSS score8.48%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.CVE-2024-22058ivantiendpoint_manager+1EPSS score0.38%
A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older.CVE-2024-32848ivantiendpoint_manager+1EPSS score43.36%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32841ivantiendpoint_manager+1EPSS score3.40%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32847ivantiendpoint_manager+1EPSS score3.16%
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32846ivantiendpoint_manager+1EPSS score2.15%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-32842ivantiendpoint_manager+1EPSS score2.15%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.