Ivanti Workspace Control vulnerabilities
22 vulnerabilities
Known vulnerabilities in Ivanti Workspace Control, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-15591ivantiworkspace_control
EPSS score1.28%
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can bypass Application Whitelisting restrictions to execute arbitrary code by leveraging multiple unspecified attack vectors.CVE-2018-15592ivantiworkspace_controlEPSS score0.59%
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can execute processes with elevated privileges via an unspecified attack vector.CVE-2018-15593ivantiworkspace_controlEPSS score1.03%
An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can decrypt the encrypted datastore or relay server password by leveraging an unspecified attack vector.CVE-2018-15590ivantiworkspace_controlEPSS score0.99%
An issue was discovered in Ivanti Workspace Control before 10.3.0.0 and RES One Workspace, when file and folder security are configured. A local authenticated user can bypass file and folder security restriction by leveraging an unspecified attack vector.CVE-2021-36235ivantiworkspace_controlEPSS score0.72%
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.CVE-2025-5353ivantiworkspace_controlEPSS score0.38%
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials.CVE-2025-22463ivantiworkspace_controlEPSS score0.36%
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password.CVE-2025-22455ivantiworkspace_controlEPSS score0.38%
A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials.CVE-2020-11533ivantiworkspace_controlEPSS score0.48%
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).CVE-2022-21823ivantiworkspace_controlEPSS score0.35%
A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.CVE-2024-44106ivantiworkspace_controlEPSS score0.24%
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.CVE-2024-44107ivantiworkspace_controlEPSS score0.27%
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.CVE-2024-44105ivantiworkspace_controlEPSS score0.16%
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.CVE-2024-44103ivantiworkspace_controlEPSS score0.24%
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.CVE-2024-44104ivantiworkspace_controlEPSS score0.24%
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.CVE-2024-8496ivantiworkspace_controlEPSS score0.21%
Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation.CVE-2024-8012ivantiworkspace_controlEPSS score0.27%
An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.CVE-2019-16382ivantiworkspace_controlEPSS score2.88%
An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file.CVE-2019-19675ivantiworkspace_controlEPSS score0.47%
In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspecified attack vector in Workspace Preferences, when it is enabled. As a result, the attacker can start applications that should be blocked.CVE-2019-19138ivantiworkspace_controlEPSS score2.16%
Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.