Ivanti Landesk Management Suite vulnerabilities
7 vulnerabilities
Known vulnerabilities in Ivanti Landesk Management Suite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2016-3147ivanti · landesk_management_suiteivanti landesk_management_suiteBuffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large packet.EPSS5.74%MediumCVE-2025-43716ivanti · landesk_management_suiteivanti landesk_management_suiteA directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can bypass access controls and gain unauthorized access to various endpoints such as /client/index.php%3F.php/gsb/firewall.php within the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.EPSS1.21%MediumCVE-2019-12375ivanti · landesk_management_suiteivanti landesk_management_suiteOpen directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information disclosure and arbitrary code execution.EPSS1.08%HighCVE-2019-12374ivanti · landesk_management_suiteivanti landesk_management_suiteA SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to improper username sanitization in the Basic Authentication implementation in core/provisioning.secure/ProvisioningSecure.asmx in Provisioning.Secure.dll.EPSS2.63%CriticalCVE-2019-12373ivanti · landesk_management_suiteivanti landesk_management_suiteImproper access control and open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote disclosure of administrator passwords.EPSS1.01%CriticalCVE-2019-12377ivanti · landesk_management_suiteivanti landesk_management_suiteA vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution.EPSS5.54%MediumCVE-2019-12376ivanti · landesk_management_suiteivanti landesk_management_suiteUse of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoint compromise by an authenticated user with read privileges.EPSS0.60%