EPM vulnerabilities
33 known vulnerabilities in EPM from Ivanti. 33 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.8 High severity
EPM: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 8.2 High severity
EPM: Improper Restriction of XML External Entity Reference
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.8 Critical severity
EPM: Deserialization of Untrusted Data
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
- 8.0 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.
- 8.0 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- 8.0 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- 8.0 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- 8.0 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
Ivanti Endpoint Manager (EPM) SQL Injection Exploited
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 8.8 High severity
EPM: Improper Neutralization of Special Elements used in an SQL Command
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- 7.8 High severity
EPM: Heap-based Buffer Overflow
A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older.