Ivanti vulnerabilities, page 4
509 vulnerabilities
Known vulnerabilities in Ivanti products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 85 products.
HighCVE-2025-55145ivanti · connect_secure +3 moreivanti connect_secureMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.EPSS0.67%MediumCVE-2025-55139ivanti · connect_secure +3 moreivanti connect_secureSSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.EPSS0.91%HighCVE-2025-55142ivanti · connect_secure +3 moreivanti connect_secureMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.EPSS0.96%MediumCVE-2025-55143ivanti · connect_secure +3 moreivanti connect_secureReflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.EPSS0.74%HighCVE-2025-55141ivanti · connect_secure +3 moreivanti connect_secureMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.EPSS0.96%HighCVE-2025-55148ivanti · connect_secure +3 moreivanti connect_secureMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.EPSS0.59%HighCVE-2025-55147ivanti · connect_secure +3 moreivanti connect_secureCSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is requiredEPSS0.63%MediumCVE-2025-55144ivanti · connect_secure +3 moreivanti connect_secureMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.EPSS0.59%MediumCVE-2025-62388ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.82%MediumCVE-2025-62389ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS1.74%MediumCVE-2025-62384ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.83%MediumCVE-2025-62387ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS1.73%MediumCVE-2025-62390ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS1.74%MediumCVE-2025-62392ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.82%MediumCVE-2025-62386ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.82%MediumCVE-2025-62385ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.82%MediumCVE-2025-62391ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.82%MediumCVE-2025-62383ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.83%HighCVE-2025-11622ivanti · endpoint_managerivanti endpoint_managerInsecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.EPSS0.78%MediumCVE-2025-11623ivanti · endpoint_managerivanti endpoint_managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.EPSS0.83%