Filtered by vendor Ivanti
Subscribe
Total
492 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-55139 | 1 Ivanti | 4 Connect Secure, Neurons For Secure Access, Policy Secure and 1 more | 2026-06-17 | N/A | 6.8 MEDIUM |
| SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services. | |||||
| CVE-2025-4428 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-06-17 | N/A | 7.2 HIGH |
| Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. | |||||
| CVE-2025-4427 | 1 Ivanti | 1 Endpoint Manager Mobile | 2026-06-17 | N/A | 5.3 MEDIUM |
| An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. | |||||
| CVE-2025-22467 | 1 Ivanti | 1 Connect Secure | 2026-06-17 | N/A | 9.9 CRITICAL |
| A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution. | |||||
| CVE-2025-22466 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 8.2 HIGH |
| Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required. | |||||
| CVE-2025-22465 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required. | |||||
| CVE-2025-22464 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 6.1 MEDIUM |
| An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition. | |||||
| CVE-2025-22463 | 1 Ivanti | 1 Workspace Control | 2026-06-17 | N/A | 7.3 HIGH |
| A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. | |||||
| CVE-2025-22462 | 1 Ivanti | 1 Neurons For Itsm | 2026-06-17 | N/A | 9.8 CRITICAL |
| An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system. | |||||
| CVE-2025-22461 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.2 HIGH |
| SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution. | |||||
| CVE-2025-22460 | 1 Ivanti | 1 Cloud Services Appliance | 2026-06-17 | N/A | 7.8 HIGH |
| Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges. | |||||
| CVE-2025-22459 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 4.8 MEDIUM |
| Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers. | |||||
| CVE-2025-22458 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.8 HIGH |
| DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. | |||||
| CVE-2025-22457 | 1 Ivanti | 3 Connect Secure, Policy Secure, Zero Trust Access Gateway | 2026-06-17 | N/A | 9.0 CRITICAL |
| A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution. | |||||
| CVE-2025-22455 | 1 Ivanti | 1 Workspace Control | 2026-06-17 | N/A | 8.8 HIGH |
| A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. | |||||
| CVE-2025-22454 | 1 Ivanti | 1 Secure Access Client | 2026-06-17 | N/A | 7.8 HIGH |
| Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. | |||||
| CVE-2025-13662 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.8 HIGH |
| Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required. | |||||
| CVE-2025-13661 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 7.1 HIGH |
| Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required. | |||||
| CVE-2025-13659 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 8.8 HIGH |
| Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required. | |||||
| CVE-2025-11623 | 1 Ivanti | 1 Endpoint Manager | 2026-06-17 | N/A | 6.5 MEDIUM |
| SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. | |||||