CVSS: 8.7EPSS: 3%CPEs: 1EXPL: 0CVE-2024-22060
https://notcve.org/view.php?id=CVE-2024-22060
31 May 2024 — An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary files into sensitive directories of ITSM server. Una vulnerabilidad de carga de archivos sin restricciones en el componente web de Ivanti Neurons para ITSM permite a un usuario remoto, autenticado y con altos privilegios escribir archivos arbitrarios en directorios confidenciales del servidor ITSM. • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 0CVE-2023-38551
https://notcve.org/view.php?id=CVE-2023-38551
31 May 2024 — A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack. Una vulnerabilidad de inyección CRLF en Ivanti Connect Secure (9.x, 22.x) permite a un usuario autenticado con altos privilegios inyectar código malicioso en el navegador de una víctima, lo que lleva a un ataque de cross-site scripting. • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22058
https://notcve.org/view.php?id=CVE-2024-22058
31 May 2024 — A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older. Un desbordamiento del búfer permite que un usuario con privilegios bajos en la máquina local que tiene instalado el Agente EPM ejecute código arbitrario con permisos elevados en Ivanti EPM 2021.1 y versiones anteriores. • https://forums.ivanti.com/s/article/CVE-2024-22058-Privilege-Escalation-for-Ivanti-Endpoint-Manager-EPM • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.3EPSS: 21%CPEs: 1EXPL: 0CVE-2024-29848 – Ivanti Avalanche FileStoreConfig Unrestricted File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29848
24 May 2024 — An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM. Una vulnerabilidad de carga de archivos sin restricciones en el componente web de Ivanti Avalanche anterior a 6.4.x permite a un usuario privilegiado y autenticado ejecutar comandos arbitrarios como SYSTEM. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication ... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29822 – Ivanti Endpoint Manager RecordGoodApp SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29822
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante no autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authenticati... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-29823 – Ivanti Endpoint Manager GetDBVulnerabilities SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29823
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante no autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authenticati... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-29825 – Ivanti Endpoint Manager RecordBrokenApp SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29825
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante no autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authenticati... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-29826 – Ivanti Endpoint Manager GetDBPatches SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29826
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante no autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authenticati... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29827 – Ivanti Endpoint Manager GetDBPatchProducts SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29827
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante no autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authenticati... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29828 – Ivanti Endpoint Manager GetRulesetsSQL SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-29828
24 May 2024 — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code. Una vulnerabilidad de inyección SQL no especificada en el servidor central de Ivanti EPM 2022 SU5 y anteriores permite que un atacante autenticado dentro de la misma red ejecute código arbitrario. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is... • https://forums.ivanti.com/s/article/Security-Advisory-May-2024 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •