RSS   Podatności dla 'Endpoint manager'   RSS

2020-11-16
 
CVE-2020-13772

NVD-CWE-noinfo
 
 
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required.

 
 
CVE-2020-13769

CWE-89
 
 
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.

 
2019-07-11
 
CVE-2019-10651

CWE-264
 
 
An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In other words, the issue affects 2017.3, 2018.1, and 2018.3 installations that lack the April 2019 update.

 
2017-12-11
 
CVE-2017-11463

CWE-275
 
 
In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in an HTTP payload in order to retrieve a key/token and use it to access/update objects belonging to other users. Such objects could be user profiles, tickets, incidents, etc.

 

 >>> Vendor: Ivanti 12 Produkty
Endpoint manager
Endpoint security
Workspace control
Landesk management suite
Avalanche
Desktop\&server management
Service manager heat remote control
Dsm netinst
Endpoint manager cloud services appliance
Service manager
Dsm remote
Incapptic connect

Copyright 2024, cxsecurity.com

 

Back to Top