Product:

Endpoint_manager

(Ivanti)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 86
Date Id Summary Products Score Patch Annotated
2025-01-14 CVE-2024-13170 An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Endpoint_manager N/A
2025-01-14 CVE-2024-13171 Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. Endpoint_manager N/A
2025-01-14 CVE-2024-13172 Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. Endpoint_manager N/A
2025-07-08 CVE-2025-6995 Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords. Endpoint_manager N/A
2025-07-08 CVE-2025-6996 Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords. Endpoint_manager N/A
2025-07-08 CVE-2025-7037 SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database Endpoint_manager N/A
2024-07-29 CVE-2024-37381 An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code. Endpoint_manager 8.0
2024-09-12 CVE-2024-37397 An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. Endpoint_manager N/A
2024-05-31 CVE-2024-22058 A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated permissions in Ivanti EPM 2021.1 and older. Endpoint_manager N/A
2025-01-14 CVE-2024-10811 Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Endpoint_manager 7.5