DeutschShown in its original language — a full translation is planned for a future version.
Ivanti Endpoint Manager: Mehrere Schwachstellen
view advisory published 2024-09-10
Ein Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, erweiterte Rechte zu erlangen und vertrauliche Informationen preiszugeben.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-37397US | — | — | ||
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to l… | ||||
| CVE-2024-34785US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-34783US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-34779US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32848US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32846US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32845US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32843US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32842US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-32840US | high7.2 | — | ||
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi… | ||||
| CVE-2024-29847US | critical9.8 | Exploit | ||
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code ex… | ||||
| CVE-2024-8441US | medium6.7 | — | ||
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their p… | ||||
| CVE-2024-8322US | high8.8 | — | ||
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality. | ||||
| CVE-2024-8321US | high8.6OT elevated | — | ||
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the… | ||||
| CVE-2024-8320US | medium5.3OT elevated | — | ||
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status o… | ||||
| CVE-2024-8191US | critical9.8 | — | ||
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan