CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-5353
https://notcve.org/view.php?id=CVE-2025-5353
10 Jun 2025 — A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455 • CWE-321: Use of Hard-coded Cryptographic Key •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22463
https://notcve.org/view.php?id=CVE-2025-22463
10 Jun 2025 — A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455 • CWE-321: Use of Hard-coded Cryptographic Key •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22455
https://notcve.org/view.php?id=CVE-2025-22455
10 Jun 2025 — A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455 • CWE-321: Use of Hard-coded Cryptographic Key •
CVSS: 8.3EPSS: 25%CPEs: 1EXPL: 4CVE-2025-4428 – Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
https://notcve.org/view.php?id=CVE-2025-4428
13 May 2025 — Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute arbitrary code via crafted API requests. This vulnerability results from an insecure implementation of the Hibernate Validator open-source library, as repr... • https://packetstorm.news/files/id/193081 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 80%CPEs: 1EXPL: 3CVE-2025-4427 – Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2025-4427
13 May 2025 — An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources without proper credentials via crafted API requests. This vulnerability results from an insecure implementation of the Spring Framework open-source library. • https://packetstorm.news/files/id/193081 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22462
https://notcve.org/view.php?id=CVE-2025-22462
13 May 2025 — An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-on-premises-only-CVE-2025-22462 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22460
https://notcve.org/view.php?id=CVE-2025-22460
13 May 2025 — Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CVE-2025-22460 • CWE-1392: Use of Default Credentials •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-43716
https://notcve.org/view.php?id=CVE-2025-43716
23 Apr 2025 — A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can bypass access controls and gain unauthorized access to various endpoints such as /client/index.php%3F.php/gsb/firewall.php within the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • https://forums.ivanti.com/s/article/Graphical-overview-of-the-LANDesk-Management-Gateway-Functionality • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22466
https://notcve.org/view.php?id=CVE-2025-22466
08 Apr 2025 — Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22465
https://notcve.org/view.php?id=CVE-2025-22465
08 Apr 2025 — Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •