Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Release: Ivanti EPM 2022 SU6, 2024 September Security Update Clear all filters
TI-2024-21713 CVE-2024-32840 · GHSA-pcxj-w6pv-x9c5

SQL injection in Ivanti EPM

Priority MEDIUM 55

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.25389 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-23070 CVE-2024-34783 · GHSA-w8hf-8rpm-xjp2

SQL injection in Ivanti EPM

Priority MEDIUM 62

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.43356 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-19621 CVE-2024-29847 · GHSA-qfx3-m2xp-3pcp

Deserialization of untrusted data in Ivanti EPM

Priority HIGH 82

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.52082 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-502
TI-2024-23066 CVE-2024-34779 · GHSA-g7wm-3q7g-g3q2

SQL injection in Ivanti EPM

Priority MEDIUM 54

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.24005 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-24902 CVE-2024-37397 · GHSA-r268-64hq-mv45

XML external entity injection in Ivanti EPM

Priority HIGH 76

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.59257 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-611
TI-2024-21721 CVE-2024-32848 · GHSA-v7mj-q2hh-7r72

SQL injection in Ivanti EPM

Priority MEDIUM 62

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.43356 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-23072 CVE-2024-34785 · GHSA-x4fw-fhfj-vm7c

SQL injection in Ivanti EPM

Priority MEDIUM 55

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.25389 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-21716 CVE-2024-32843 · GHSA-35pg-8ph2-rp9c

SQL injection in Ivanti EPM

Priority LOW 38

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0215 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-21719 CVE-2024-32846 · GHSA-22q6-7m3g-6r77

SQL injection in Ivanti EPM

Priority LOW 38

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0215 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-21718 CVE-2024-32845 · GHSA-f53w-fw63-qjpw

SQL injection in Ivanti EPM

Priority MEDIUM 54

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.24005 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89
TI-2024-21715 CVE-2024-32842 · GHSA-wfg8-6fh4-8fp9

SQL injection in Ivanti EPM

Priority LOW 38

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0215 Published 2024-09-12 Fixed in 2024 September Security Update, 2022 SU6 CWE-89