# Ivanti Avalanche.

Every CVE that names Ivanti Avalanche among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [XML external entity injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-46265.md)
  `CVE-2023-46265` · CVE record: Ivanti Avalanche · CVSS 6.5 Medium · Not analysed yet · Published 19 Dec 2023 · Tags: XML external entities (XXE)
- [Out-of-bounds write in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-46257.md)
  `CVE-2023-46257` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 19 Dec 2023 · Tags: Memory corruption
- [An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).](https://agentprime.io/advisories/CVE-2023-46804.md)
  `CVE-2023-46804` · CVE record: Ivanti Avalanche · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2023
- [Ivanti Avalanche: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche…](https://agentprime.io/advisories/CVE-2023-46263.md)
  `CVE-2023-46263` · CVE record: Ivanti Avalanche · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 19 Dec 2023
- [An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.](https://agentprime.io/advisories/CVE-2023-46225.md)
  `CVE-2023-46225` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 19 Dec 2023
- [An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.](https://agentprime.io/advisories/CVE-2023-46259.md)
  `CVE-2023-46259` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 19 Dec 2023
- [Stack-based buffer overflow in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-46223.md)
  `CVE-2023-46223` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2023 · Tags: Memory corruption
- [An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.](https://agentprime.io/advisories/CVE-2021-22962.md)
  `CVE-2021-22962` · CVE record: Ivanti Avalanche · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.91 · Not analysed yet · Published 19 Dec 2023
- [Incorrect default permissions in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-41726.md)
  `CVE-2023-41726` · CVE record: Ivanti Avalanche · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2023 · Tags: Broken access control
- [Unrestricted file upload in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-41725.md)
  `CVE-2023-41725` · CVE record: Ivanti Avalanche · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2023 · Tags: Unrestricted file upload
- [Missing authentication in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-43554.md)
  `CVE-2022-43554` · CVE record: Ivanti Avalanche · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2023 · Tags: Authentication bypass
- [Missing authentication in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-43555.md)
  `CVE-2022-43555` · CVE record: Ivanti Avalanche · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2023 · Tags: Authentication bypass
- [Out-of-bounds write in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-32560.md)
  `CVE-2023-32560` · CVE record: Ivanti Avalanche · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.99 · Not analysed yet · Published 10 Aug 2023 · Tags: Memory corruption, CWE-20
- [Information disclosure in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-32561.md)
  `CVE-2023-32561` · CVE record: Ivanti Avalanche · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2023 · Tags: Information disclosure
- [Unrestricted file upload in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2023-32562.md)
  `CVE-2023-32562` · CVE record: Ivanti Avalanche · CVSS 6.8 Medium · EPSS 0.46 · Not analysed yet · Published 10 Aug 2023 · Tags: Unrestricted file upload
- [An unauthenticated attacker could achieve the code execution through a RemoteControl server.](https://agentprime.io/advisories/CVE-2023-32563.md)
  `CVE-2023-32563` · CVE record: Ivanti Avalanche · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 10 Aug 2023
- [Ivanti Avalanche: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche…](https://agentprime.io/advisories/CVE-2023-32564.md)
  `CVE-2023-32564` · CVE record: Ivanti Avalanche · CVSS 6.8 Medium · EPSS 0.44 · Not analysed yet · Published 10 Aug 2023
- [An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.](https://agentprime.io/advisories/CVE-2023-32565.md)
  `CVE-2023-32565` · CVE record: Ivanti Avalanche · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2023
- [An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.](https://agentprime.io/advisories/CVE-2023-32566.md)
  `CVE-2023-32566` · CVE record: Ivanti Avalanche · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2023
- [Missing authentication in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36983.md)
  `CVE-2022-36983` · CVE record: Ivanti Avalanche · CVSS 7.5 High · Not analysed yet · Published 29 Mar 2023 · Tags: Authentication bypass
- [Path traversal in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36982.md)
  `CVE-2022-36982` · CVE record: Ivanti Avalanche · CVSS 6.5 Medium · EPSS 0.74 · Not analysed yet · Published 29 Mar 2023 · Tags: Path traversal
- [Path traversal in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36981.md)
  `CVE-2022-36981` · CVE record: Ivanti Avalanche · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.83 · Not analysed yet · Published 29 Mar 2023 · Tags: Path traversal
- [Time-of-check time-of-use race condition in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36980.md)
  `CVE-2022-36980` · CVE record: Ivanti Avalanche · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 29 Mar 2023 · Tags: Race condition
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36979.md)
  `CVE-2022-36979` · CVE record: Ivanti Avalanche · CVSS 7.5 High · Not analysed yet · Published 29 Mar 2023 · Tags: SQL injection
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36978.md)
  `CVE-2022-36978` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36977.md)
  `CVE-2022-36977` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: Insecure deserialization
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36976.md)
  `CVE-2022-36976` · CVE record: Ivanti Avalanche · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: SQL injection
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36975.md)
  `CVE-2022-36975` · CVE record: Ivanti Avalanche · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: SQL injection
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36974.md)
  `CVE-2022-36974` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.84 · Not analysed yet · Published 29 Mar 2023 · Tags: Insecure deserialization
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36973.md)
  `CVE-2022-36973` · CVE record: Ivanti Avalanche · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: SQL injection
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36972.md)
  `CVE-2022-36972` · CVE record: Ivanti Avalanche · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2023 · Tags: SQL injection
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-36971.md)
  `CVE-2022-36971` · CVE record: Ivanti Avalanche · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 29 Mar 2023 · Tags: Insecure deserialization
- [Improper authentication in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2022-44574.md)
  `CVE-2022-44574` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.64 · Not analysed yet · Published 10 Mar 2023 · Tags: Authentication bypass
- [Unrestricted file upload in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42133.md)
  `CVE-2021-42133` · CVE record: Ivanti Avalanche · No CVSS score · Not analysed yet · Published 7 Dec 2021 · Tags: Unrestricted file upload
- [Command injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42132.md)
  `CVE-2021-42132` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.70 · Not analysed yet · Published 7 Dec 2021 · Tags: Command injection
- [SQL injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42131.md)
  `CVE-2021-42131` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.67 · Not analysed yet · Published 7 Dec 2021 · Tags: SQL injection
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42130.md)
  `CVE-2021-42130` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.62 · Not analysed yet · Published 7 Dec 2021 · Tags: Insecure deserialization
- [Command injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42129.md)
  `CVE-2021-42129` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.77 · Not analysed yet · Published 7 Dec 2021 · Tags: Command injection
- [Ivanti Avalanche: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using…](https://agentprime.io/advisories/CVE-2021-42128.md)
  `CVE-2021-42128` · CVE record: Ivanti Avalanche · No CVSS score · Not analysed yet · Published 7 Dec 2021 · Tags: CWE-749
- [Deserialization of untrusted data in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42127.md)
  `CVE-2021-42127` · CVE record: Ivanti Avalanche · No CVSS score · EPSS 0.66 · Not analysed yet · Published 7 Dec 2021 · Tags: Insecure deserialization
- [Improper authorization in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42126.md)
  `CVE-2021-42126` · CVE record: Ivanti Avalanche · No CVSS score · Not analysed yet · Published 7 Dec 2021 · Tags: Broken access control
- [Improper access control in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2021-42124.md)
  `CVE-2021-42124` · CVE record: Ivanti Avalanche · No CVSS score · Not analysed yet · Published 7 Dec 2021 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/technology/ivanti-avalanche.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=ivanti-avalanche&cursor=WyIyMDIzLTEyLTE5VDE1OjQzOjI2LjMyOTAwMFoiLCJDVkUtMjAyMy00NjIyMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/ivanti-avalanche/?cursor=WyIyMDIzLTEyLTE5VDE1OjQzOjI2LjMyOTAwMFoiLCJDVkUtMjAyMy00NjIyMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.