NCSC-VD-2512-001-06
الرقم المرجعي: NCSC-VD-2512-001-06
Ivanti
الوصف
CVE-2025-10573: A stored cross-site scripting vulnerability in Ivanti Endpoint Manager allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator session. User interaction is required.
CVE-2025-13659: An unauthenticated arbitrary file write flaw in Ivanti EPM that can lead to remote code execution, requiring user interaction.
CVE-2025-13661: An authenticated path traversal vulnerability in Ivanti EPM enabling arbitrary file write outside intended directories, requiring user interaction.
CVE-2025-13662: An unauthenticated cryptographic signature verification bypass in Ivanti EPM leading to arbitrary code execution, requiring user interaction.
الثغرات
- CVE-2025-10573
A stored cross-site scripting vulnerability in Ivanti Endpoint Manager allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator session. User interaction is required.
- CVE-2025-13659
An unauthenticated arbitrary file write flaw in Ivanti EPM that can lead to remote code execution, requiring user interaction.
- CVE-2025-13661
An authenticated path traversal vulnerability in Ivanti EPM enabling arbitrary file write outside intended directories, requiring user interaction.
- CVE-2025-13662
An unauthenticated cryptographic signature verification bypass in Ivanti EPM leading to arbitrary code execution, requiring user interaction.