Endpoint Manager vulnerabilities
87 known vulnerabilities in Endpoint Manager from Ivanti. 87 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- 8.1 High severity
Endpoint Manager: Improper Certificate Validation
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
- 7.7 High severity
Endpoint Manager: External Control of File Name or Path
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Read
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
- 8.8 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
- 7.8 High severity
Endpoint Manager: Incorrect Permission Assignment for Critical Resource
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Authentication Bypass Exploited
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
- 8.0 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
- 8.8 High severity
Endpoint Manager: Improper Control of Dynamically-Managed Code Resources
Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is
- 7.1 High severity
Endpoint Manager: Incorrect Default Permissions
Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk
- 8.8 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 8.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 8.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 8.4 High severity
Endpoint Manager: Storing Passwords in a Recoverable Format
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
- 9.6 Critical severity
Endpoint Manager: Improper Neutralization of Input During Web Page Generation
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.
- 7.8 High severity
Endpoint Manager: Improper Verification of Cryptographic Signature
Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.8 High severity
Endpoint Manager: Unrestricted Upload of File with Dangerous Type
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Endpoint Manager: Out-of-bounds Read
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.5 High severity
Endpoint Manager: Out-of-bounds Write
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- 7.8 High severity
Endpoint Manager: Use of Uninitialized Resource
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
- 7.8 High severity
Endpoint Manager: Deserialization of Untrusted Data
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
- 7.2 High severity
Endpoint Manager: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.5 High severity
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Exploited
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.2 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.5 High severity
Endpoint Manager: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
EPM: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.