Policy Secure (Ivanti) - vulnerabilities (CVEs)

78 CVEs, 0 in the last 30 days, 77 known versions, newest CVE from 2025-09-09. Vendor: Ivanti.

CVEs of Policy Secure

CVE-2025-55148 - CVSS 7.6 (high), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55147 - CVSS 8.8 (high), 2025-09-09: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…
CVE-2025-8712 - CVSS 5.4 (medium), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and…
CVE-2025-8711 - CVSS 5.4 (medium), 2025-09-09: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…
CVE-2025-55142 - CVSS 8.8 (high), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55145 - CVSS 8.9 (high), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55144 - CVSS 5.4 (medium), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55143 - CVSS 6.1 (medium), 2025-09-09: Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55146 - CVSS 4.9 (medium), 2025-09-09: An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55141 - CVSS 8.8 (high), 2025-09-09: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
CVE-2025-55139 - CVSS 6.8 (medium), 2025-09-09: SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…
CVE-2025-5468 - CVSS 5.5 (medium), 2025-08-12: Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway…
CVE-2025-5466 - CVSS 4.9 (medium), 2025-08-12: XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for…
CVE-2025-5456 - CVSS 7.5 (high), 2025-08-12: A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before…
CVE-2025-5462 - CVSS 7.5 (high), 2025-08-12: A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723…
CVE-2023-39339 - CVSS 4.9 (medium), 2025-07-12: A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a…
CVE-2025-0293 - CVSS 6.6 (medium), 2025-07-08: CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with…
CVE-2025-0292 - CVSS 5.5 (medium), 2025-07-08: SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin…
CVE-2025-5463 - CVSS 5.5 (medium), 2025-07-08: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a…
CVE-2025-5451 - CVSS 4.9 (medium), 2025-07-08: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated…
CVE-2025-5450 - CVSS 6.3 (medium), 2025-07-08: Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version…
CVE-2025-22457 - CVSS 9.8 (critical), 2025-04-03: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before…
CVE-2024-38657 - CVSS 9.1 (critical), 2025-02-21: External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote…
CVE-2024-13842 - CVSS 6 (medium), 2025-02-11: A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with…
CVE-2024-13830 - CVSS 6.1 (medium), 2025-02-11: Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to…
CVE-2024-13843 - CVSS 6 (medium), 2025-02-11: Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local…
CVE-2024-10644 - CVSS 9.1 (critical), 2025-02-11: Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with…
CVE-2024-12058 - CVSS 6.8 (medium), 2025-02-11: External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote…
CVE-2025-0283 - CVSS 7 (high), 2025-01-08: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…
CVE-2025-0282 - CVSS 9 (critical), 2025-01-08: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…
CVE-2024-37401 - CVSS 7.5 (high), 2024-12-12: An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-37377 - CVSS 7.5 (high), 2024-12-12: A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-11634 - CVSS 9.1 (critical), 2024-12-10: Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker…
CVE-2024-39712 - CVSS 9.1 (critical), 2024-11-13: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote…
CVE-2024-39711 - CVSS 9.1 (critical), 2024-11-13: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote…
CVE-2024-39710 - CVSS 9.1 (critical), 2024-11-13: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote…
CVE-2024-39709 - CVSS 7.8 (high), 2024-11-13: Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not…
CVE-2024-38656 - CVSS 9.1 (critical), 2024-11-13: Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote…
CVE-2024-38655 - CVSS 9.1 (critical), 2024-11-13: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote…
CVE-2024-11006 - CVSS 9.1 (critical), 2024-11-12: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable…
CVE-2024-11005 - CVSS 9.1 (critical), 2024-11-12: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable…
CVE-2024-11004 - CVSS 6.1 (medium), 2024-11-12: Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to…
CVE-2024-9420 - CVSS 8.8 (high), 2024-11-12: A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated…
CVE-2024-8495 - CVSS 7.5 (high), 2024-11-12: A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated…
CVE-2024-47909 - CVSS 4.9 (medium), 2024-11-12: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated…
CVE-2024-47906 - CVSS 7.8 (high), 2024-11-12: Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not…
CVE-2024-47905 - CVSS 4.9 (medium), 2024-11-12: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated…
CVE-2024-11007 - CVSS 9.1 (critical), 2024-11-12: Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable…
CVE-2024-37404 - CVSS 9.1 (critical), 2024-10-18: Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote…
CVE-2024-29205 - CVSS 7.5 (high), 2024-04-25: An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,…
CVE-2024-21894 - CVSS 9.8 (critical), 2024-04-04: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to…
CVE-2024-22052 - CVSS 7.5 (high), 2024-04-04: A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious…
CVE-2024-22023 - CVSS 5.3 (medium), 2024-04-04: An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated…
CVE-2024-22053 - CVSS 8.2 (high), 2024-04-04: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send…
CVE-2024-22024 - CVSS 8.3 (high), 2024-02-13: An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways…
CVE-2024-21893 - CVSS 8.2 (high), 2024-01-31: A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons…
CVE-2024-21888 - CVSS 8.8 (high), 2024-01-31: A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate…
CVE-2024-21887 - CVSS 9.1 (critical), 2024-01-12: A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated…
CVE-2023-46805 - CVSS 8.2 (high), 2024-01-12: An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted…
CVE-2022-35254 - CVSS 7.5 (high), 2022-12-05: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2,…
CVE-2022-35258 - CVSS 7.5 (high), 2022-12-05: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2,…
CVE-2020-8262 - CVSS 6.1 (medium), 2020-10-28: A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection…
CVE-2020-8261 - CVSS 4.3 (medium), 2020-10-28: A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
CVE-2020-15352 - CVSS 7.2 (high), 2020-10-27: An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated…
CVE-2020-8243 - CVSS 7.2 (high), 2020-09-30: A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an…
CVE-2020-8238 - CVSS 6.1 (medium), 2020-09-30: A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site…
CVE-2020-8221 - CVSS 4.9 (medium), 2020-07-30: A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web…
CVE-2020-8222 - CVSS 6.8 (medium), 2020-07-30: A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an…
CVE-2020-8206 - CVSS 8.1 (high), 2020-07-30: An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google…
CVE-2020-8218 - CVSS 7.2 (high), 2020-07-30: A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the…
CVE-2020-8204 - CVSS 6.1 (medium), 2020-07-30: A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.
CVE-2020-8217 - CVSS 5.4 (medium), 2020-07-30: A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.
CVE-2020-8220 - CVSS 6.5 (medium), 2020-07-30: A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the…
CVE-2020-8216 - CVSS 4.3 (medium), 2020-07-30: An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the…
CVE-2020-8219 - CVSS 7.2 (high), 2020-07-30: An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.
CVE-2020-12880 - CVSS 5.5 (medium), 2020-07-27: An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot…
CVE-2019-11509 - CVSS 8.8 (high), 2019-06-03: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS)…
CVE-2019-11539 - CVSS 8 (high), 2019-04-26: In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy…