Ivanti
Ivanti Endpoint Manager Cloud Services Appliance: vulnerabilidades y CVE
Ivanti Endpoint Manager Cloud Services Appliance tiene 5 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 4 figuran en el catálogo de explotación activa de CISA.
CVE5
Últimos 12 meses0
Críticas2
Explotadas activamente4
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-9380 | Alta (7.2) | 60% | ⚠ Explotación activa | 8 oct 2024 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. |
| CVE-2024-9379 | Alta (7.2) | 44% | ⚠ Explotación activa | 8 oct 2024 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. |
| CVE-2024-8963 | Crítica (9.1) | 99% | ⚠ Explotación activa | 19 sept 2024 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
| CVE-2021-44529 | Crítica (9.8) | 99% | ⚠ Explotación activa | 8 dic 2021 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-9381 | Alta (7.2) | 16% | — | 8 oct 2024 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. |
| CVE-2024-9380 | Alta (7.2) | 60% | ⚠ Explotación activa | 8 oct 2024 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. |
| CVE-2024-9379 | Alta (7.2) | 44% | ⚠ Explotación activa | 8 oct 2024 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. |
| CVE-2024-8963 | Crítica (9.1) | 99% | ⚠ Explotación activa | 19 sept 2024 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
| CVE-2021-44529 | Crítica (9.8) | 99% | ⚠ Explotación activa | 8 dic 2021 | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.