Report feedback

An unauthenticated remote attacker can perform a stored XSS attack in the context of a logged-in administrator's session [1].

The vulnerability is present in product:

• Ivanti Endpoint Manager; <2024 SU4 SR1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

• CVE-2025-10573 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 12. 2025.

Under certain conditions, an unauthenticated remote attacker can write arbitrary files to the server and potentially execute code [1].

The vulnerability is present in product:

• Ivanti Endpoint Manager; <2024 SU4 SR1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-13659 at cve.org, NVD
• CWE-913: Improper Control of Dynamically-Managed Code Resources at cwe.mitre.org

The vulnerability was publicly disclosed 8. 12. 2025.

Due to insufficient verification of cryptographic signatures in update management, an unauthenticated remote attacker can, under certain conditions, execute code [1].

The vulnerability is present in product:

• Ivanti Endpoint Manager; <2024 SU4 SR1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-13662 at cve.org, NVD
• CWE-347: Improper Verification of Cryptographic Signature at cwe.mitre.org

The vulnerability was publicly disclosed 8. 12. 2025.

Under certain conditions, an authenticated remote attacker can write arbitrary files outside the designated directory [1].

The vulnerability is present in product:

• Ivanti Endpoint Manager; <2024 SU4 SR1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-13661 at cve.org, NVD
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 12. 2025.