| CVE-2024-47905 | MOYENNE4.9 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to cause a denial of service. | 12/11/2024 |
| CVE-2024-11007 | ÉLEVÉE7.2 | Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution. | 12/11/2024 |
| CVE-2024-37404 | ÉLEVÉE8.8 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. | 18/10/2024 |
| CVE-2024-29821 | ÉLEVÉE7.8 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector. | 18/10/2024 |
| CVE-2024-29213 | ÉLEVÉE7.8 | Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector. | 18/10/2024 |
| CVE-2024-9381 | ÉLEVÉE7.2 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. | 08/10/2024 |
| CVE-2024-9380KEV | ÉLEVÉE7.2 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. | 08/10/2024 |
| CVE-2024-9379KEV | ÉLEVÉE7.2 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. | 08/10/2024 |
| CVE-2024-9167 | ÉLEVÉE7.8 | Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacker to achieve local privilege escalation. | 08/10/2024 |
| CVE-2024-7612 | ÉLEVÉE7.8 | Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. | 08/10/2024 |
| CVE-2024-47011 | ÉLEVÉE7.5 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information | 08/10/2024 |
| CVE-2024-47010 | CRITIQUE9.8 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. | 08/10/2024 |
| CVE-2024-47009 | CRITIQUE9.8 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. | 08/10/2024 |
| CVE-2024-47008 | ÉLEVÉE7.5 | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. | 08/10/2024 |
| CVE-2024-47007 | ÉLEVÉE7.5 | A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service. | 08/10/2024 |
| CVE-2024-8963KEV | CRITIQUE9.1 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | 19/09/2024 |
| CVE-2024-37397 | ÉLEVÉE8.2 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. | 12/09/2024 |
| CVE-2024-34785 | ÉLEVÉE7.2 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. | 12/09/2024 |
| CVE-2024-34783 | ÉLEVÉE7.2 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. | 12/09/2024 |
| CVE-2024-34779 | ÉLEVÉE7.2 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution. | 12/09/2024 |