CVE-2024-39710

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-397119.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a CVE-2024-397129.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r CVE-2024-397138.6A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.CVE-2024-397149.9A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution CVE-2024-397158.5A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC CVE-2024-397177.2The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user log CVE-2024-397188.1An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival CVE-2024-397197.5An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route wit CVE-2024-39724.3The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which CVE-2024-397208.2An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 byt CVE-2024-397217.5An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path CVE-2024-397227.5An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in th