Endpoint Manager Cloud Services Appliance vulnerabilities

5 known vulnerabilities in Endpoint Manager Cloud Services Appliance from Ivanti. 5 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Ivanti Cloud Services Appliance (CSA) OS Command Injection Exploited

  CVE-2024-9380Oct 8, 2024IvantiEPSS 58.3%

  An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

• 7.2 High severity

  Ivanti Cloud Services Appliance (CSA) SQL Injection Exploited

  CVE-2024-9379Oct 8, 2024IvantiEPSS 44.3%

  SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

• 9.1 Critical severity

  Ivanti Cloud Services Appliance (CSA) Path Traversal Exploited

  CVE-2024-8963Sep 19, 2024IvantiEPSS 98.6%

  Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

• 7.2 High severity

  Ivanti Cloud Services Appliance OS Command Injection Exploited

  CVE-2024-8190Sep 10, 2024IvantiEPSS 88.5%

  An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

• 9.8 Critical severity

  Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Exploited

  CVE-2021-44529Dec 8, 2021Ivanti EPMEPSS 99.1%

  A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).