CVE-2024-44106

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-602

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-441077.8DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker CVE-2024-44116.4The Mihdan: Yandex Turbo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all version CVE-2024-441124.3Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative CVE-2024-441134.3Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the n CVE-2024-441142.7SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the CVE-2024-441154.3The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be uti CVE-2024-441164.3The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability coul CVE-2024-441175.4The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite CVE-2024-44122.7The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code CVE-2024-441204.7SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An un CVE-2024-441214.3Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherw CVE-2024-441228.8A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, macOS