CVE-2024-29824

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Oct 2, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298258.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam CVE-2024-298268.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam CVE-2024-298278.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam CVE-2024-298288.0An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same CVE-2024-298298.0An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same CVE-2024-29838.8A vulnerability was found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this issue is the function formSetClientStat CVE-2024-298308.0An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same CVE-2024-298318.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be CVE-2024-298326.1The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The v CVE-2024-298335.4The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scri CVE-2024-298346.4This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, CVE-2024-298369.8The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an