DeutschShown in its original language — a full translation is planned for a future version.
Ivanti Connect Secure, Policy Secure und Secure Access Client: Mehrere Schwachstellen
view advisory published 2025-02-11
Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Rechte zu erweitern, beliebigen Code auszuführen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38657US | medium4.9 | — | ||
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… | ||||
| CVE-2025-22467US | high8.8 | — | ||
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution. | ||||
| CVE-2024-13843US | medium4.4OT elevated | — | ||
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin… | ||||
| CVE-2024-13842US | medium4.4OT elevated | — | ||
A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to rea… | ||||
| CVE-2024-13830US | medium6.1 | — | ||
Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges.… | ||||
| CVE-2024-13813US | high7.1 | — | ||
Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files. | ||||
| CVE-2024-12058US | medium4.9 | — | ||
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-10644US | high7.2 | — | ||
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to ach… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan