Advisories · Technology

Ivanti Avalanche.

Every CVE that names Ivanti Avalanche among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-8297 CVE record

CVSS 7.2 High

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 12 Aug 2025
CVE-2025-8296 CVE record

CVSS 7.2 High

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 12 Aug 2025
CVE-2023-38036 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Buffer overflow in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 12 Jul 2025
CVE-2024-13181 CVE record

CVSS 7.3 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
- Authentication bypass
Not analysed yet 14 Jan 2025
CVE-2024-13180 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 14 Jan 2025
CVE-2024-13179 CVE record

CVSS 7.3 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
- Authentication bypass
Not analysed yet 14 Jan 2025
CVE-2024-50331 CVE record

CVSS 7.5 High

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-50321 CVE record

CVSS 7.5 High

Infinite loop in Ivanti Avalanche
- Ivanti Avalanche
- Denial of service
Not analysed yet 12 Nov 2024
CVE-2024-50320 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Infinite loop in Ivanti Avalanche
- Ivanti Avalanche
- Denial of service
Not analysed yet 12 Nov 2024
CVE-2024-50319 CVE record

CVSS 7.5 High

Infinite loop in Ivanti Avalanche
- Ivanti Avalanche
- Denial of service
Not analysed yet 12 Nov 2024
CVE-2024-50318 CVE record

CVSS 7.5 High

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-50317 CVE record

CVSS 7.5 High

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 12 Nov 2024
CVE-2024-47011 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 8 Oct 2024
CVE-2024-47010 CVE record

CVSS 7.3 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
- Authentication bypass
Not analysed yet 8 Oct 2024
CVE-2024-47009 CVE record

CVSS 7.3 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
- Authentication bypass
Not analysed yet 8 Oct 2024
CVE-2024-47008 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Server-side request forgery in Ivanti Avalanche
- Ivanti Avalanche
- Server-side request forgery (SSRF)
Not analysed yet 8 Oct 2024
CVE-2024-47007 CVE record

CVSS 7.5 High

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 8 Oct 2024
CVE-2024-38652 CVE record

CVSS 8.2 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 14 Aug 2024
CVE-2024-37373 CVE record

CVSS 7.2 High

Improper input validation in Ivanti Avalanche
- Ivanti Avalanche
- CWE-20
Not analysed yet 14 Aug 2024
CVE-2024-37399 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 14 Aug 2024
CVE-2024-38653 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

XML external entity injection in Ivanti Avalanche
- Ivanti Avalanche
- XML external entities (XXE)
Not analysed yet 14 Aug 2024
CVE-2024-36136 CVE record

CVSS 7.5 High

Off-by-one error in Ivanti Avalanche
- Ivanti Avalanche
- CWE-193
Not analysed yet 14 Aug 2024
CVE-2024-29848 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 31 May 2024
CVE-2024-23527 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 24 Apr 2024
CVE-2024-23526 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-22061 CVE record

CVSS 8.1 High

Command injection in Ivanti Avalanche
- Ivanti Avalanche
- Command injection
Not analysed yet 19 Apr 2024
CVE-2024-23529 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-23528 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-25000 CVE record

CVSS 8.8 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-27977 CVE record

CVSS 7.1 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-24992 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-23532 CVE record

CVSS 7.5 High

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-23535 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-24998 CVE record

CVSS 8.8 High

Ivanti Avalanche: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a…
- Ivanti Avalanche
- CWE-31
Not analysed yet 19 Apr 2024
CVE-2024-24995 CVE record

CVSS 8.8 High

Time-of-check time-of-use race condition in Ivanti Avalanche
- Ivanti Avalanche
- Race condition
Not analysed yet 19 Apr 2024
CVE-2024-24993 CVE record

CVSS 8.8 High

Time-of-check time-of-use race condition in Ivanti Avalanche
- Ivanti Avalanche
- Race condition
Not analysed yet 19 Apr 2024
CVE-2024-24997 CVE record

CVSS 8.8 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-24991 CVE record

CVSS 6.5 Medium

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-27978 CVE record

CVSS 6.5 Medium

NULL pointer dereference in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-24994 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-24996 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Heap-based buffer overflow in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-23534 CVE record

CVSS 8.8 High

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 19 Apr 2024
CVE-2024-23533 CVE record

CVSS 4.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-23531 CVE record

CVSS 7.5 High

Integer overflow in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-23530 CVE record

CVSS 5.3 Medium

Out-of-bounds read in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-27976 CVE record

CVSS 8.8 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2024-29204 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Heap-based buffer overflow in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-27975 CVE record

CVSS 8.8 High

Use after free in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Apr 2024
CVE-2024-27984 CVE record

CVSS 7.1 High

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 19 Apr 2024
CVE-2023-46220 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46261 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46266 CVE record

CVSS 7.3 High

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46260 CVE record

CVSS 7.5 High

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46258 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46803 CVE record

CVSS 7.5 High

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46264 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Ivanti Avalanche: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche…
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46262 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Ivanti Avalanche: An unauthenticated attacked could send a specifically crafted web request causing a…
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46224 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out-of-bounds write in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Dec 2023
CVE-2023-46221 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46222 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023