Vulnerabilities > Ivanti

DATE CVE VULNERABILITY TITLE RISK
2020-11-16 CVE-2020-13769 SQL Injection vulnerability in Ivanti Endpoint Manager
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.
network
low complexity
ivanti CWE-89
8.8
2020-11-12 CVE-2020-13774 Unrestricted Upload of File with Dangerous Type vulnerability in Ivanti Endpoint Manager 2019.1/2020.1
An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file.
network
low complexity
ivanti CWE-434
critical
9.9
2020-11-12 CVE-2020-13771 Uncontrolled Search Path Element vulnerability in Ivanti Endpoint Manager
Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of privileges to the level of privilege held by the vulnerable component such as NT AUTHORITY\SYSTEM) via DLL hijacking.
local
low complexity
ivanti CWE-427
7.8
2020-11-12 CVE-2020-13770 Incorrect Default Permissions vulnerability in Ivanti Endpoint Manager
Several services are accessing named pipes in Ivanti Endpoint Manager through 2020.1.1 with default or overly permissive security attributes; as these services run as user ‘NT AUTHORITY\SYSTEM’, the issue can be used to escalate privileges from a local standard or service account having SeImpersonatePrivilege (eg.
local
low complexity
ivanti CWE-276
7.8
2020-10-28 CVE-2020-8262 Cross-site Scripting vulnerability in multiple products
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.
network
low complexity
pulsesecure ivanti CWE-79
6.1
2020-10-28 CVE-2020-8261 Classic Buffer Overflow vulnerability in multiple products
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
network
low complexity
pulsesecure ivanti CWE-120
4.3
2020-10-27 CVE-2020-15352 XXE vulnerability in multiple products
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
network
low complexity
pulsesecure ivanti CWE-611
7.2
2020-09-30 CVE-2020-8256 XXE vulnerability in multiple products
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.
network
low complexity
pulsesecure ivanti CWE-611
4.9
2020-09-30 CVE-2020-8243 Code Injection vulnerability in multiple products
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
network
low complexity
pulsesecure ivanti CWE-94
7.2
2020-09-30 CVE-2020-8238 Cross-site Scripting vulnerability in multiple products
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).
network
low complexity
pulsesecure ivanti CWE-79
6.1