Product:

Endpoint_manager

(Ivanti)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 84
Date Id Summary Products Score Patch Annotated
2025-07-08 CVE-2025-7037 SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database Endpoint_manager N/A
2024-07-29 CVE-2024-37381 An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code. Endpoint_manager 8.0
2024-09-12 CVE-2024-37397 An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. Endpoint_manager N/A
2024-05-31 CVE-2024-22058 A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older. Endpoint_manager N/A
2025-01-14 CVE-2024-10811 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Endpoint_manager 7.5
2024-01-09 CVE-2023-39336 An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server. Endpoint_manager 8.8
2022-09-23 CVE-2022-30121 The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their system. Endpoint_manager 6.7
2022-09-23 CVE-2022-30121 The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their system. Endpoint_manager 6.7
2025-04-08 CVE-2025-22458 DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. Endpoint_manager 7.8
2025-04-08 CVE-2025-22459 Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers. Endpoint_manager 4.8