CVE-2025-13659

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

In Ivanti Endpoint Manager before version 2024 SU6, incorrect permissions assignment in the agent allows a local authenticated attacker to escalate their privileges.

Ivanti Endpoint Manager prior to version 2024 SU4 SR1 contains a stored XSS vulnerability that allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Path traversal vulnerability in Ivanti Endpoint Manager before version 2024 SU4. A remote unauthenticated attacker can achieve remote code execution, though user interaction is required.

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

Ivanti Endpoint Manager before 2024 SU7 transmits sensitive information in cleartext, allowing a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

Ivanti Endpoint Manager before 2024 SU7 has a vulnerability related to external control of a filename, allowing a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

Ivanti Endpoint Manager before 2024 SU7 has an out-of-bounds read vulnerability in the Agent, allowing a remote unauthenticated attacker to crash an agent service.

Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.