Ivanti vulnerabilities, page 2
509 vulnerabilities
Known vulnerabilities in Ivanti products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 85 products.
CVE-2021-42124ivantiavalanche
EPSS score2.69%
An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover.CVE-2021-42126ivantiavalancheEPSS score4.00%
An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.CVE-2021-42128ivantiavalancheEPSS score4.65%
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service.CVE-2021-42130ivantiavalancheEPSS score62.24%
A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution.CVE-2021-42125ivantiavalancheEPSS score81.60%
An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.CVE-2021-42133ivantiavalancheEPSS score2.90%
An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write.CVE-2021-42129ivantiavalancheEPSS score77.26%
A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.CVE-2021-42127ivantiavalancheEPSS score65.83%
A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.CVE-2021-36235ivantiworkspace_controlEPSS score0.72%
An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.CVE-2021-38560ivantiservice_managerEPSS score2.89%
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.CVE-2021-22938ivanticonnect_secure+1EPSS score2.10%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console.CVE-2021-22936ivanticonnect_secure+1EPSS score0.85%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter.CVE-2021-22934ivanticonnect_secure+1EPSS score4.67%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.CVE-2021-22935ivanticonnect_secure+1EPSS score2.10%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter.CVE-2021-22900ivanticonnect_secure+1KEVEPSS score14.15%
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.CVE-2021-22962ivantiavalancheEPSS score91.00%
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2021-22894ivanticonnect_secureKEVEPSS score41.28%
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.CVE-2021-22933ivanticonnect_secure+1EPSS score1.38%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request.CVE-2021-22937ivanticonnect_secure+1EPSS score7.83%
A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface.CVE-2021-22908ivanticonnect_secure+1EPSS score69.38%
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.