| CVE-2022-21828 | ALTO7.2 | A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3. | 04/03/2022 |
| CVE-2021-38560 | MÉDIO6.1 | Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx. | 01/02/2022 |
| CVE-2022-21823 | MÉDIO5.5 | A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector. | 10/01/2022 |
| CVE-2019-19138 | ALTO7.5 | Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity. | 15/12/2021 |
| CVE-2021-44529KEV | CRÍTICO9.8 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). | 08/12/2021 |
| CVE-2021-42133 | ALTO8.1 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write. | 07/12/2021 |
| CVE-2021-42132 | ALTO8.8 | A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. | 07/12/2021 |
| CVE-2021-42131 | ALTO8.8 | A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. | 07/12/2021 |
| CVE-2021-42130 | ALTO8.8 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution. | 07/12/2021 |
| CVE-2021-42129 | ALTO8.8 | A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. | 07/12/2021 |
| CVE-2021-42128 | CRÍTICO9.8 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service. | 07/12/2021 |
| CVE-2021-42127 | CRÍTICO9.8 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service. | 07/12/2021 |
| CVE-2021-42126 | ALTO8.8 | An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. | 07/12/2021 |
| CVE-2021-42125 | ALTO8.8 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files. | 07/12/2021 |
| CVE-2021-42124 | ALTO8.8 | An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover. | 07/12/2021 |
| CVE-2021-22965 | ALTO7.5 | A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a malformed request is sent to the device. | 19/11/2021 |
| CVE-2021-36235 | ALTO7.8 | An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges. | 01/09/2021 |
| CVE-2021-22938 | ALTO7.2 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitized web parameter in the administrator web console. | 16/08/2021 |
| CVE-2021-22937 | ALTO7.2 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. | 16/08/2021 |
| CVE-2021-22936 | MÉDIO6.1 | A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticated administrator via an unsanitized web parameter. | 16/08/2021 |