Threat database

155 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	8.4	EPSS 0.2%	CVE-2025-6995Endpoint Manager · Storing Passwords in a Recoverable Format High8.4EPSS 0.2%2025-07-08CVE Database V5CVE-2025-6995 Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords. EPSS 0.2%Vulnerability Ivanti #cwe-257 Germany+7	CVE Database V5	2025-07-08
High	8.8	EPSS 0.4%	CVE-2025-5353Workspace Control · Use of Hard-coded Cryptographic Key High8.8EPSS 0.4%2025-06-10CVE Database V5CVE-2025-5353 A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. EPSS 0.4%Vulnerability Ivanti #cwe-321 United States+11	CVE Database V5	2025-06-10
High	7.3	EPSS 0.4%	CVE-2025-22463Workspace Control · Use of Hard-coded Cryptographic Key High7.3EPSS 0.4%2025-06-10CVE Database V5CVE-2025-22463 A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. EPSS 0.4%Vulnerability Ivanti #cwe-321 United States+10	CVE Database V5	2025-06-10
High	8.8	EPSS 0.4%	CVE-2025-22455Workspace Control · Use of Hard-coded Cryptographic Key High8.8EPSS 0.4%2025-06-10CVE Database V5CVE-2025-22455 A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. EPSS 0.4%Vulnerability Ivanti #cwe-321 United States+9	CVE Database V5	2025-06-10
High	7.2	EPSS 1.5%	CVE-2025-22461Endpoint Manager · SQL Injection High7.2EPSS 1.5%2025-04-08CVE Database V5CVE-2025-22461 SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution. EPSS 1.5%Vulnerability Ivanti #cwe-89 United States+12	CVE Database V5	2025-04-08
High	7.8	EPSS 0.3%	CVE-2025-22454Secure Access Client · Incorrect Permission Assignment for Critical Resource High7.8EPSS 0.3%2025-03-11CVE Database V5CVE-2025-22454 Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. EPSS 0.3%Vulnerability Ivanti #cwe-732 United States+11	CVE Database V5	2025-03-11
Critical	9.1	EPSS 2.8%	CVE-2024-10644Connect Secure · Code Injection Critical9.1EPSS 2.8%2025-02-11CVE Database V5CVE-2024-10644 Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. EPSS 2.8%Vulnerability Ivanti #cwe-94 United States+9	CVE Database V5	2025-02-11
Critical	9.9	EPSS 4.7%	CVE-2025-22467Connect Secure · Stack-based Buffer Overflow Critical9.9EPSS 4.7%2025-02-11CVE Database V5CVE-2025-22467 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution. EPSS 4.7%Vulnerability Ivanti #cwe-121 United States+12	CVE Database V5	2025-02-11
Critical	9.1	EPSS 22%	CVE-2024-47908Cloud Services Application · OS Command Injection Critical9.1EPSS 22%2025-02-11CVE Database V5CVE-2024-47908 OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution. EPSS 22%Vulnerability Ivanti #cwe-78 United States+9	CVE Database V5	2025-02-11
High	7.2	EPSS 65%	CVE-2024-13162Endpoint Manager · SQL Injection High7.2EPSS 65%2025-01-14CVE Database V5CVE-2024-13162 SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848. EPSS 65%Vulnerability Ivanti #cwe-89 United States+10	CVE Database V5	2025-01-14
High	7.8	EPSS 9.2%	CVE-2024-13163Endpoint Manager · Deserialization of Untrusted Data High7.8EPSS 9.2%2025-01-14CVE Database V5CVE-2024-13163 Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. EPSS 9.2%Vulnerability Ivanti #cwe-502 United States+9	CVE Database V5	2025-01-14
High	7.8	EPSS 0.4%	CVE-2024-13164Endpoint Manager · Use of Uninitialized Resource High7.8EPSS 0.4%2025-01-14CVE Database V5CVE-2024-13164 An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. EPSS 0.4%Vulnerability Ivanti #cwe-908 United States+9	CVE Database V5	2025-01-14
High	7.8	EPSS 0.4%	CVE-2024-13169Endpoint Manager · Out-of-bounds Read High7.8EPSS 0.4%2025-01-14CVE Database V5CVE-2024-13169 An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. EPSS 0.4%Vulnerability Ivanti #cwe-125 #cwe-843 United States+11	CVE Database V5	2025-01-14
High	7.8	EPSS 17%	CVE-2024-13171Endpoint Manager · Unrestricted Upload of File with Dangerous Type High7.8EPSS 17%2025-01-14CVE Database V5CVE-2024-13171 Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. EPSS 17%Vulnerability Ivanti #cwe-434 United States+11	CVE Database V5	2025-01-14
High	7.8	EPSS 0.5%	CVE-2024-13172Endpoint Manager · Improper Verification of Cryptographic Signature High7.8EPSS 0.5%2025-01-14CVE Database V5CVE-2024-13172 Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. EPSS 0.5%Vulnerability Ivanti #cwe-347 United States+12	CVE Database V5	2025-01-14
High	7.2	EPSS 3.4%	CVE-2024-13158Endpoint Manager · Untrusted Search Path High7.2EPSS 3.4%2025-01-14CVE Database V5CVE-2024-13158 An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. EPSS 3.4%Vulnerability Ivanti #cwe-426 #cwe-22 United States+9	CVE Database V5	2025-01-14
Critical	9.8	KEVEPSS 99%	CVE-2024-13159Endpoint Manager · Absolute Path Traversal Critical9.8KEVEPSS 99%2025-01-14CVE Database V5CVE-2024-13159 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. KEVEPSS 99%Vulnerability Ivanti #cwe-36 United States+12	CVE Database V5	2025-01-14
Critical	9.8	KEVEPSS 90%	CVE-2024-13160Endpoint Manager · Absolute Path Traversal Critical9.8KEVEPSS 90%2025-01-14CVE Database V5CVE-2024-13160 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. KEVEPSS 90%Vulnerability Ivanti #cwe-36 United States+11	CVE Database V5	2025-01-14
Critical	9.8	KEVEPSS 89%	CVE-2024-13161Endpoint Manager · Absolute Path Traversal Critical9.8KEVEPSS 89%2025-01-14CVE Database V5CVE-2024-13161 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. KEVEPSS 89%Vulnerability Ivanti #cwe-36 United States+9	CVE Database V5	2025-01-14
Critical	9.8	EPSS 3.5%	CVE-2024-10811Endpoint Manager · Absolute Path Traversal Critical9.8EPSS 3.5%2025-01-14CVE Database V5CVE-2024-10811 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. EPSS 3.5%Vulnerability Ivanti #cwe-36 United States+12	CVE Database V5	2025-01-14

Showing 101–120 of 155 results