EM
Product
Endpoint Manager
On CISA KEVExploited in the wild
119
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 10High 85Medium 24Low 0
Watch
Add Endpoint Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-13166 | 7.5 | Jan 14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-13167 | 7.5 | Jan 14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-13168 | 7.5 | Jan 14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-13170 | 7.5 | Jan 14 | An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-10811 | 7.5 | Jan 14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2023-38343 | 7.5 | Sep 21 | An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4 Affected: before 2022; 2022; 2022; 2022; 2022 |
| CVE-2023-35077 | 7.5 | Jul 21 | An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash Affected: before 7.9.1.285 |
| CVE-2025-7037 | 7.2 | Jul 8 | SQL injection in Ivanti Endpoint Manager Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +7 more |
| CVE-2025-22461 | 7.2 | Apr 8 | SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +3 more |
| CVE-2024-13162 | 7.2 | Jan 14 | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-13158 | 7.2 | Jan 14 | An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with… Affected: before 2024; 2022; 2022; 2022; 2022; 2022; +1 more |
| CVE-2024-34784 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34780 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34781 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32839 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32844 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32847 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32841 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34782 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-37376 | 7.2 | Nov 13 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-50328 | 7.2 | Nov 12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-50327 | 7.2 | Nov 12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-50326 | 7.2 | Nov 12 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-50324 | 7.2 | Nov 12 | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32840 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34783 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34779 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32848 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-34785 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32843 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32845 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32846 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2024-32842 | 7.2 | Sep 12 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code… Affected: before 2022; 2022; 2022; 2022; 2022; 2022; +2 more |
| CVE-2025-10918 | 7.1 | Nov 11 | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk Affected: before 2024; 2024; 2024; 2024; 2024; 2024 |
| CVE-2024-10256 | 7.1 | Dec 10 | Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files Affected: 2022; 2022; 2022; 2022; 2022; 2022; +2 more |