Advisories · Technology

Ivanti Avalanche.

Every CVE that names Ivanti Avalanche among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-46265 CVE record

CVSS 6.5 Medium

XML external entity injection in Ivanti Avalanche
- Ivanti Avalanche
- XML external entities (XXE)
Not analysed yet 19 Dec 2023
CVE-2023-46257 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Out-of-bounds write in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Dec 2023
CVE-2023-46804 CVE record

CVSS 7.5 High

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46263 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Ivanti Avalanche: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche…
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46225 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46259 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-46223 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Stack-based buffer overflow in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
Not analysed yet 19 Dec 2023
CVE-2021-22962 CVE record

CVSS 7.3 HighCritical · CVSS 7+ and EPSS

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- Ivanti Avalanche
Not analysed yet 19 Dec 2023
CVE-2023-41726 CVE record

CVSS 7.8 High

Incorrect default permissions in Ivanti Avalanche
- Ivanti Avalanche
- Broken access control
Not analysed yet 3 Nov 2023
CVE-2023-41725 CVE record

CVSS 7.8 High

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 3 Nov 2023
CVE-2022-43554 CVE record

CVSS 7.8 High

Missing authentication in Ivanti Avalanche
- Ivanti Avalanche
- Authentication bypass
Not analysed yet 3 Nov 2023
CVE-2022-43555 CVE record

CVSS 7.8 High

Missing authentication in Ivanti Avalanche
- Ivanti Avalanche
- Authentication bypass
Not analysed yet 3 Nov 2023
CVE-2023-32560 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Out-of-bounds write in Ivanti Avalanche
- Ivanti Avalanche
- Memory corruption
- CWE-20
Not analysed yet 10 Aug 2023
CVE-2023-32561 CVE record

CVSS 7.1 High

Information disclosure in Ivanti Avalanche
- Ivanti Avalanche
- Information disclosure
Not analysed yet 10 Aug 2023
CVE-2023-32562 CVE record

CVSS 6.8 Medium

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 10 Aug 2023
CVE-2023-32563 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

An unauthenticated attacker could achieve the code execution through a RemoteControl server.
- Ivanti Avalanche
Not analysed yet 10 Aug 2023
CVE-2023-32564 CVE record

CVSS 6.8 Medium

Ivanti Avalanche: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche…
- Ivanti Avalanche
Not analysed yet 10 Aug 2023
CVE-2023-32565 CVE record

CVSS 6.3 Medium

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- Ivanti Avalanche
Not analysed yet 10 Aug 2023
CVE-2023-32566 CVE record

CVSS 6.3 Medium

An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- Ivanti Avalanche
Not analysed yet 10 Aug 2023
CVE-2022-36983 CVE record

CVSS 7.5 High

Missing authentication in Ivanti Avalanche
- Ivanti Avalanche
- Authentication bypass
Not analysed yet 29 Mar 2023
CVE-2022-36982 CVE record

CVSS 6.5 Medium

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 29 Mar 2023
CVE-2022-36981 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Path traversal in Ivanti Avalanche
- Ivanti Avalanche
- Path traversal
Not analysed yet 29 Mar 2023
CVE-2022-36980 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Time-of-check time-of-use race condition in Ivanti Avalanche
- Ivanti Avalanche
- Race condition
Not analysed yet 29 Mar 2023
CVE-2022-36979 CVE record

CVSS 7.5 High

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 29 Mar 2023
CVE-2022-36978 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 29 Mar 2023
CVE-2022-36977 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 29 Mar 2023
CVE-2022-36976 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 29 Mar 2023
CVE-2022-36975 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 29 Mar 2023
CVE-2022-36974 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 29 Mar 2023
CVE-2022-36973 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 29 Mar 2023
CVE-2022-36972 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 29 Mar 2023
CVE-2022-36971 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 29 Mar 2023
CVE-2022-44574 CVE record

Improper authentication in Ivanti Avalanche
- Ivanti Avalanche
- Authentication bypass
Not analysed yet 10 Mar 2023
CVE-2021-42133 CVE record

Unrestricted file upload in Ivanti Avalanche
- Ivanti Avalanche
- Unrestricted file upload
Not analysed yet 7 Dec 2021
CVE-2021-42132 CVE record

Command injection in Ivanti Avalanche
- Ivanti Avalanche
- Command injection
Not analysed yet 7 Dec 2021
CVE-2021-42131 CVE record

SQL injection in Ivanti Avalanche
- Ivanti Avalanche
- SQL injection
Not analysed yet 7 Dec 2021
CVE-2021-42130 CVE record

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 7 Dec 2021
CVE-2021-42129 CVE record

Command injection in Ivanti Avalanche
- Ivanti Avalanche
- Command injection
Not analysed yet 7 Dec 2021
CVE-2021-42128 CVE record

Ivanti Avalanche: An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using…
- Ivanti Avalanche
- CWE-749
Not analysed yet 7 Dec 2021
CVE-2021-42127 CVE record

Deserialization of untrusted data in Ivanti Avalanche
- Ivanti Avalanche
- Insecure deserialization
Not analysed yet 7 Dec 2021
CVE-2021-42126 CVE record

Improper authorization in Ivanti Avalanche
- Ivanti Avalanche
- Broken access control
Not analysed yet 7 Dec 2021
CVE-2021-42124 CVE record

Improper access control in Ivanti Avalanche
- Ivanti Avalanche
- Broken access control
Not analysed yet 7 Dec 2021