VULNERABILITY

CVE search

Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.

Severity

CríticoAltoMédioBaixoExploited in the wild (KEV)

Language / ecosystem

JavaScript / TypeScript (npm)Python (PyPI)PHP (Packagist)Java / Kotlin (Maven)GoRuby (RubyGems).NET (NuGet)

Stack

JavaScript / Node.js

Next.jsNuxtReactAngularSvelte / SvelteKitAstroRemixViteExpressNestJSFastifyNode.jsaxios

PHP

LaravelSymfonyPHP

Python

DjangoFlaskFastAPI / Starlette

Ruby

Ruby on Rails

Java

Spring

GinFiber

CMS

WordPressWooCommerceDrupalGhostStrapi

Servers & databases

nginxApache HTTP ServerMySQLPostgreSQLRedis

Vendor1

ivantioracleibmgoogleadobemicrosoftmozillaciscoapacheappleredhatjenkinshpAll vendors →

ivanti products

connect secure 131avalanche 117endpoint manager 116policy secure 77endpoint manager mobile 29workspace control 22secure access client 21zero trust access gateway 17neurons for secure access 15neurons for itsm 14cloud services appliance 7desktop & server management 6

402.942 vulnerabilities · 1.766 actively exploited (CISA KEV)

ivanti ✕Clear filters

504 results

ID	Severity	Summary	Published
CVE-2024-38649	ALTO7.5	An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.	13/11/2024
CVE-2024-37400	ALTO7.5	An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service.	13/11/2024
CVE-2024-37398	ALTO7.8	Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.	13/11/2024
CVE-2024-37376	ALTO7.2	SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.