Ivanti IPS vulnerabilities

5 vulnerabilities

Known vulnerabilities in Ivanti IPS, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.2CVE-2024-21893ivanticonnect_secure+4KEVRansomware
EPSS score
100.00%
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.9.1CVE-2024-21887ivanticonnect_secure+3KEVRansomware
EPSS score
100.00%
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.8.8CVE-2024-21888ivanticonnect_secure+3
EPSS score
85.42%
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.8.3CVE-2024-22024ivantics+5
EPSS score
94.72%
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.8.2CVE-2023-46805ivanticonnect_secure+3KEVRansomware
EPSS score
99.99%
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.