Ivanti Endpoint Manager vulnerabilities

Ivanti Endpoint Manager before 2024 SU7 has a vulnerability related to external control of a filename, allowing a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

Ivanti Endpoint Manager before 2024 SU7 has an out-of-bounds read vulnerability in the Agent, allowing a remote unauthenticated attacker to crash an agent service.

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

In Ivanti Endpoint Manager before version 2024 SU6, incorrect permissions assignment in the agent allows a local authenticated attacker to escalate their privileges.

Ivanti Endpoint Manager prior to version 2024 SU4 SR1 contains a stored XSS vulnerability that allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.

Ivanti Endpoint Manager before 2024 SU7 transmits sensitive information in cleartext, allowing a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.