Advisories · Technology

Ivanti Policy Secure.

Every CVE that names Ivanti Policy Secure among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-55144 CVE record

CVSS 5.4 Medium

Missing authorization in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-55143 CVE record

CVSS 6.1 Medium

Cross-site scripting in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2025
CVE-2025-55142 CVE record

CVSS 8.8 High

Missing authorization in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-55141 CVE record

CVSS 8.8 High

Missing authorization in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-55139 CVE record

CVSS 6.8 Medium

Server-side request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Server-side request forgery (SSRF)
Not analysed yet 9 Sept 2025
CVE-2025-55148 CVE record

CVSS 7.6 High

Missing authorization in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-55147 CVE record

CVSS 8.8 High

Cross-site request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-55146 CVE record

CVSS 4.9 Medium

Unchecked return value in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-252
Not analysed yet 9 Sept 2025
CVE-2025-55145 CVE record

CVSS 8.9 High

Missing authorization in Ivanti Connect Secure 22.7R2.9 and others
- Ivanti Connect Secure 22.7R2.9
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-8711 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2025
CVE-2025-8712 CVE record

CVSS 5.4 Medium

Missing authorization in Ivanti Connect Secure before and others
- Ivanti Connect Secure before
- Ivanti Policy Secure
- Broken access control
Not analysed yet 9 Sept 2025
CVE-2025-5468 CVE record

CVSS 5.5 Medium

Ivanti Connect Secure: Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-61
Not analysed yet 12 Aug 2025
CVE-2025-5466 CVE record

CVSS 4.9 Medium

XML entity expansion in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Denial of service
Not analysed yet 12 Aug 2025
CVE-2025-5462 CVE record

CVSS 7.5 High

Heap-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Aug 2025
CVE-2025-5456 CVE record

CVSS 7.5 High

Out-of-bounds read in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Aug 2025
CVE-2023-39339 CVE record

CVSS 4.9 Medium

Path traversal in Ivanti Policy Secure
- Ivanti Policy Secure
- Path traversal
Not analysed yet 12 Jul 2025
CVE-2025-0292 CVE record

CVSS 5.5 Medium

Server-side request forgery in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Server-side request forgery (SSRF)
Not analysed yet 8 Jul 2025
CVE-2025-0293 CVE record

CVSS 6.6 Medium

CRLF injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Other injection
Not analysed yet 8 Jul 2025
CVE-2025-5463 CVE record

CVSS 5.5 Medium

Sensitive information in log files in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Information disclosure
Not analysed yet 8 Jul 2025
CVE-2025-5451 CVE record

CVSS 4.9 Medium

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 8 Jul 2025
CVE-2025-5450 CVE record

CVSS 6.3 Medium

Ivanti Connect Secure: Improper access control in the certificate management component of Ivanti Connect Secure…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-602
Not analysed yet 8 Jul 2025
CVE-2025-22457 CVE record

CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 3 Apr 2025
CVE-2024-38657 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

External control of a file path in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Path traversal
Not analysed yet 21 Feb 2025
CVE-2024-13843 CVE record

CVSS 6.0 Medium

Cleartext storage of sensitive information in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Information disclosure
Not analysed yet 11 Feb 2025
CVE-2024-13842 CVE record

CVSS 6.0 Medium

Hard-coded cryptographic key in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Hard-coded credentials
Not analysed yet 11 Feb 2025
CVE-2024-13830 CVE record

CVSS 6.1 Medium

Cross-site scripting in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2025
CVE-2024-12058 CVE record

CVSS 6.8 Medium

External control of a file path in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Path traversal
Not analysed yet 11 Feb 2025
CVE-2024-10644 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Code injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Code injection
Not analysed yet 11 Feb 2025
CVE-2025-0283 CVE record

CVSS 7.0 HighCritical · CVSS 7+ and EPSS

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 8 Jan 2025
CVE-2025-0282 CVE record

CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 8 Jan 2025
CVE-2024-11634 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Command injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 10 Dec 2024
CVE-2024-38655 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Argument injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 13 Nov 2024
CVE-2024-39712 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Argument injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 13 Nov 2024
CVE-2024-39711 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Argument injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 13 Nov 2024
CVE-2024-39709 CVE record

CVSS 7.8 High

Incorrect permission assignment in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Broken access control
Not analysed yet 13 Nov 2024
CVE-2024-38656 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Argument injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 13 Nov 2024
CVE-2024-39710 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Argument injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 13 Nov 2024
CVE-2024-11004 CVE record

CVSS 6.1 Medium

Cross-site scripting in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Cross-site scripting (XSS)
Not analysed yet 12 Nov 2024
CVE-2024-11005 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

OS command injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 12 Nov 2024
CVE-2024-11006 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

OS command injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 12 Nov 2024
CVE-2024-11007 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

OS command injection in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Command injection
Not analysed yet 12 Nov 2024
CVE-2024-8495 CVE record

CVSS 7.5 High

NULL pointer dereference in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-47909 CVE record

CVSS 4.9 Medium

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-47906 CVE record

CVSS 7.8 High

Untrusted search path in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Privilege escalation
- CWE-426
Not analysed yet 12 Nov 2024
CVE-2024-9420 CVE record

CVSS 8.8 High

Use after free in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-47905 CVE record

CVSS 4.9 Medium

Stack-based buffer overflow in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-37404 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Ivanti Connect Secure: Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1…
- Ivanti Connect Secure
- Ivanti Policy Secure
Not analysed yet 18 Oct 2024
CVE-2024-29205 CVE record

CVSS 7.5 High

Ivanti Connect Secure: An Improper Check for Unusual or Exceptional Conditions vulnerability in the web…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-703
Not analysed yet 24 Apr 2024
CVE-2024-21894 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Ivanti Connect Secure: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-703
Not analysed yet 4 Apr 2024
CVE-2024-22053 CVE record

CVSS 8.2 High

Ivanti Connect Secure: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-703
Not analysed yet 4 Apr 2024
CVE-2024-22052 CVE record

CVSS 7.5 High

Ivanti Connect Secure: A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-703
Not analysed yet 4 Apr 2024
CVE-2024-22023 CVE record

CVSS 5.3 Medium

Ivanti Connect Secure: An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure…
- Ivanti Connect Secure
- Ivanti Policy Secure
- CWE-703
Not analysed yet 4 Apr 2024