Avalanche (Ivanti) - vulnerabilities (CVEs)

117 CVEs, 0 in the last 30 days, 49 known versions, newest CVE from 2025-08-12. Vendor: Ivanti.

CVEs of Avalanche

CVE-2025-8297 - CVSS 7.2 (high), 2025-08-12: Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve…
CVE-2025-8296 - CVSS 7.2 (high), 2025-08-12: SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In…
CVE-2023-38036 - CVSS 9.8 (critical), 2025-07-12: A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could…
CVE-2024-13179 - CVSS 9.8 (critical), 2025-01-14: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
CVE-2024-13181 - CVSS 9.8 (critical), 2025-01-14: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes…
CVE-2024-13180 - CVSS 7.5 (high), 2025-01-14: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete…
CVE-2024-50331 - CVSS 7.5 (high), 2024-11-12: An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory.
CVE-2024-50321 - CVSS 7.5 (high), 2024-11-12: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-50319 - CVSS 7.5 (high), 2024-11-12: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-50318 - CVSS 7.5 (high), 2024-11-12: A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-50317 - CVSS 7.5 (high), 2024-11-12: A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-50320 - CVSS 7.5 (high), 2024-11-12: An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVE-2024-47011 - CVSS 7.5 (high), 2024-10-08: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information
CVE-2024-47010 - CVSS 9.8 (critical), 2024-10-08: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVE-2024-47008 - CVSS 7.5 (high), 2024-10-08: Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.
CVE-2024-47007 - CVSS 7.5 (high), 2024-10-08: A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of…
CVE-2024-47009 - CVSS 9.8 (critical), 2024-10-08: Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
CVE-2024-38652 - CVSS 9.1 (critical), 2024-08-14: Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary…
CVE-2024-38653 - CVSS 8.2 (high), 2024-08-14: XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.
CVE-2024-36136 - CVSS 7.5 (high), 2024-08-14: An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.
CVE-2024-37399 - CVSS 7.5 (high), 2024-08-14: A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.
CVE-2024-37373 - CVSS 7.2 (high), 2024-08-14: Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE.
CVE-2024-29848 - CVSS 7.2 (high), 2024-05-31: An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary…
CVE-2024-23527 - CVSS 7.5 (high), 2024-04-25: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated…
CVE-2024-27976 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-27984 - CVSS 7.1 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files…
CVE-2024-27975 - CVSS 8.8 (high), 2024-04-19: An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary…
CVE-2024-27978 - CVSS 6.5 (medium), 2024-04-19: A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform…
CVE-2024-27977 - CVSS 8.1 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby…
CVE-2024-29204 - CVSS 9.8 (critical), 2024-04-19: A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary…
CVE-2024-24995 - CVSS 8.8 (high), 2024-04-19: A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands…
CVE-2024-24998 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24997 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24999 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24996 - CVSS 9.8 (critical), 2024-04-19: A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary…
CVE-2024-25000 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24992 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24991 - CVSS 6.5 (medium), 2024-04-19: A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform…
CVE-2024-24994 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-23535 - CVSS 8.8 (high), 2024-04-19: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
CVE-2024-24993 - CVSS 8.8 (high), 2024-04-19: A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands…
CVE-2024-23534 - CVSS 8.8 (high), 2024-04-19: An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary…
CVE-2024-23526 - CVSS 7.5 (high), 2024-04-19: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated…
CVE-2024-23530 - CVSS 7.5 (high), 2024-04-19: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated…
CVE-2024-23533 - CVSS 6.5 (medium), 2024-04-19: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote…
CVE-2024-23529 - CVSS 7.5 (high), 2024-04-19: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated…
CVE-2024-23532 - CVSS 7.5 (high), 2024-04-19: An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial…
CVE-2024-23528 - CVSS 7.5 (high), 2024-04-19: An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated…
CVE-2024-23531 - CVSS 7.5 (high), 2024-04-19: An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial…
CVE-2024-22061 - CVSS 9.8 (critical), 2024-04-19: A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary…
CVE-2023-41474 - CVSS 6.5 (medium), 2024-01-25: Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the…
CVE-2023-46804 - CVSS 7.5 (high), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVE-2023-46264 - CVSS 9.8 (critical), 2023-12-19: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove…
CVE-2023-46803 - CVSS 7.5 (high), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
CVE-2023-46263 - CVSS 9.8 (critical), 2023-12-19: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote…
CVE-2023-46266 - CVSS 9.1 (critical), 2023-12-19: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
CVE-2023-46262 - CVSS 7.5 (high), 2023-12-19: An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control…
CVE-2023-46265 - CVSS 9.8 (critical), 2023-12-19: An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
CVE-2023-46261 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46257 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46260 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46225 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46259 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46224 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46258 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46220 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46223 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46217 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46222 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46216 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-46221 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2023-41727 - CVSS 9.8 (critical), 2023-12-19: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or…
CVE-2021-22962 - CVSS 9.1 (critical), 2023-12-19: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
CVE-2023-41725 - CVSS 7.8 (high), 2023-11-03: Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability
CVE-2023-41726 - CVSS 7.8 (high), 2023-11-03: Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability
CVE-2022-43555 - CVSS 7.8 (high), 2023-11-03: Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability
CVE-2022-43554 - CVSS 7.8 (high), 2023-11-03: Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability
CVE-2023-32561 - CVSS 7.5 (high), 2023-08-10: A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed…
CVE-2023-32564 - CVSS 9.8 (critical), 2023-08-10: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove…
CVE-2023-32560 - CVSS 9.8 (critical), 2023-08-10: An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.…
CVE-2023-32563 - CVSS 9.8 (critical), 2023-08-10: An unauthenticated attacker could achieve the code execution through a RemoteControl server.
CVE-2023-32562 - CVSS 9.8 (critical), 2023-08-10: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove…
CVE-2023-32565 - CVSS 9.1 (critical), 2023-08-10: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version…
CVE-2023-32567 - CVSS 9.8 (critical), 2023-08-10: Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236
CVE-2023-32566 - CVSS 9.1 (critical), 2023-08-10: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version…
CVE-2023-28126 - CVSS 5.9 (medium), 2023-05-09: An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser…
CVE-2023-28125 - CVSS 5.9 (medium), 2023-05-09: An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by…
CVE-2023-28128 - CVSS 7.2 (high), 2023-05-09: An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove…
CVE-2023-28127 - CVSS 7.5 (high), 2023-05-09: A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure.
CVE-2022-36977 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
CVE-2022-36980 - CVSS 9.4 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
CVE-2022-36983 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit…
CVE-2022-36973 - CVSS 9.1 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
CVE-2022-36976 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within…
CVE-2022-36979 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
CVE-2022-36982 - CVSS 7.5 (high), 2023-03-29: This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is…
CVE-2022-36975 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within…
CVE-2022-36978 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
CVE-2022-36981 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is…
CVE-2022-36974 - CVSS 9.8 (critical), 2023-03-29: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…