Ivanti Avalanche
92 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-8297 | fixed in 6.4.8.8008 | Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin priv | HIGH 7.2 | 1.3 % | ||
| CVE-2025-8296 | fixed in 6.4.8.8008 | SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrar | HIGH 7.2 | 1.1 % | ||
| CVE-2023-38036 | 6.4.0 – < 6.4.1 | A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overf | CRITICAL 9.8 | 2.8 % | ||
| CVE-2024-13181 | fixed in 6.4.7 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresse | CRITICAL 9.8 | 33 % | ||
| CVE-2024-13180 | fixed in 6.4.7 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE add | HIGH 7.5 | 27 % | ||
| CVE-2024-13179 | fixed in 6.4.7 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8 | 64 % | ||
| CVE-2024-50331 | fixed in 6.4.6 | An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information | HIGH 7.5 | 1.1 % | ||
| CVE-2024-50321 | fixed in 6.4.6 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. | HIGH 7.5 | 1.2 % | ||
| CVE-2024-50320 | fixed in 6.4.6 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. | HIGH 7.5 | 40 % | ||
| CVE-2024-50319 | fixed in 6.4.6 | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. | HIGH 7.5 | 1.2 % | ||
| CVE-2024-50318 | fixed in 6.4.6 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. | HIGH 7.5 | 1.2 % | ||
| CVE-2024-50317 | fixed in 6.4.6 | A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. | HIGH 7.5 | 1.2 % | ||
| CVE-2024-47011 | fixed in 6.4.5 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information | HIGH 7.5 | 56 % | ||
| CVE-2024-47010 | fixed in 6.4.5 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8 | 38 % | ||
| CVE-2024-47009 | fixed in 6.4.5 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8 | 1.7 % | ||
| CVE-2024-47008 | fixed in 6.4.5 | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. | HIGH 7.5 | 47 % | ||
| CVE-2024-47007 | fixed in 6.4.5 | A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to ca | HIGH 7.5 | 1.7 % | ||
| CVE-2024-38653 | 6.4.4 – < 6.4.4 | XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. | HIGH 8.2 | 92 % | ||
| CVE-2024-38652 | 6.4.4 – < 6.4.4 | Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of serv | CRITICAL 9.1 | 7.6 % | ||
| CVE-2024-37399 | 6.4.4 – < 6.4.4 | A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, re | HIGH 7.5 | 28 % | ||
| CVE-2024-37373 | 6.4.4 – < 6.4.4 | Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to ach | HIGH 7.2 | 1.6 % | ||
| CVE-2024-36136 | 6.4.4 – < 6.4.4 | An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting | HIGH 7.5 | 2.2 % | ||
| CVE-2024-29848 | 6.4.3 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to exec | HIGH 7.2 | 64 % | ||
| CVE-2024-23527 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una | HIGH 7.5 | 2.0 % | ||
| CVE-2024-23526 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una | HIGH 7.5 | 1.9 % | ||
| CVE-2024-22061 | 6.4.3 – < 6.4.3 | A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex | CRITICAL 9.8 | 3.6 % | ||
| CVE-2024-23529 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una | HIGH 7.5 | 1.9 % | ||
| CVE-2024-23528 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una | HIGH 7.5 | 1.9 % | ||
| CVE-2024-25000 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 3.0 % | ||
| CVE-2024-29204 | 6.4.3 – < 6.4.3 | A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to e | CRITICAL 9.8 | 4.3 % | ||
| CVE-2024-27984 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific t | HIGH 7.1 | 1.8 % | ||
| CVE-2024-27978 | 6.4.3 – < 6.4.3 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote att | MEDIUM 6.5 | 1.7 % | ||
| CVE-2024-27977 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary | HIGH 8.1 | 1.8 % | ||
| CVE-2024-27976 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 3.2 % | ||
| CVE-2024-27975 | 6.4.3 – < 6.4.3 | An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to e | HIGH 8.8 | 2.6 % | ||
| CVE-2024-24998 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 3.2 % | ||
| CVE-2024-24997 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 3.2 % | ||
| CVE-2024-24996 | 6.4.3 – < 6.4.3 | A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to e | CRITICAL 9.8 | 32 % | ||
| CVE-2024-24995 | 6.4.3 – < 6.4.3 | A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute | HIGH 8.8 | 2.4 % | ||
| CVE-2024-24994 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 68 % | ||
| CVE-2024-24993 | 6.4.3 – < 6.4.3 | A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute | HIGH 8.8 | 2.4 % | ||
| CVE-2024-24992 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 71 % | ||
| CVE-2024-24991 | 6.4.3 – < 6.4.3 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote att | MEDIUM 6.5 | 1.7 % | ||
| CVE-2024-23535 | 6.4.3 – < 6.4.3 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary | HIGH 8.8 | 68 % | ||
| CVE-2024-23534 | 6.4.3 – < 6.4.3 | An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execut | HIGH 8.8 | 2.7 % | ||
| CVE-2024-23533 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an aut | MEDIUM 6.5 | 1.4 % | ||
| CVE-2024-23532 | 6.4.3 – < 6.4.3 | An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker | HIGH 7.5 | 1.8 % | ||
| CVE-2024-23531 | 6.4.3 – < 6.4.3 | An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker | HIGH 7.5 | 2.4 % | ||
| CVE-2024-23530 | 6.4.3 – < 6.4.3 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una | HIGH 7.5 | 1.9 % | ||
| CVE-2023-46804 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | HIGH 7.5 | 4.1 % | ||
| CVE-2023-46803 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | HIGH 7.5 | 4.1 % | ||
| CVE-2023-46266 | 6.4.1 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. | CRITICAL 9.1 | 3.5 % | ||
| CVE-2023-46265 | 6.4.1 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). | CRITICAL 9.8 | 4.0 % | ||
| CVE-2023-46264 | 6.4.1 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t | CRITICAL 9.8 | 90 % | ||
| CVE-2023-46263 | 6.4.1 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t | CRITICAL 9.8 | 82 % | ||
| CVE-2023-46262 | 6.4.1 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R | HIGH 7.5 | 83 % | ||
| CVE-2023-46261 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 11 % | ||
| CVE-2023-46260 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 9.8 % | ||
| CVE-2023-46259 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 11 % | ||
| CVE-2023-46258 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 6.8 % | ||
| CVE-2023-46257 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 11 % | ||
| CVE-2023-46225 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 11 % | ||
| CVE-2023-46224 | 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 6.8 % | ||
| CVE-2023-46223 | fixed in 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 6.8 % | ||
| CVE-2023-46222 | fixed in 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 6.8 % | ||
| CVE-2023-46221 | fixed in 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 6.8 % | ||
| CVE-2023-46220 | fixed in 6.4.1 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of | CRITICAL 9.8 | 11 % | ||
| CVE-2021-22962 | 6.4.1 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. | CRITICAL 9.1 | 91 % | ||
| CVE-2023-41726 | 6.4.1.236 – < 6.4.1.236 | Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.6 % | ||
| CVE-2023-41725 | 6.4.1.236 – < 6.4.1.236 | Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.7 % | ||
| CVE-2022-43555 | 6.4.1.236 – < 6.4.1.236 | Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.5 % | ||
| CVE-2022-43554 | | Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.5 % | ||
| CVE-2023-32560 | | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co | CRITICAL 9.8 | 99 % | ||
| CVE-2023-32561 | | A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentica | HIGH 7.5 | 2.4 % | ||
| CVE-2023-32562 | | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t | CRITICAL 9.8 | 46 % | ||
| CVE-2023-32563 | | An unauthenticated attacker could achieve the code execution through a RemoteControl server. | CRITICAL 9.8 | 89 % | ||
| CVE-2023-32564 | | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t | CRITICAL 9.8 | 44 % | ||
| CVE-2023-32565 | | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. F | CRITICAL 9.1 | 2.2 % | ||
| CVE-2023-32566 | | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. F | CRITICAL 9.1 | 2.4 % | ||
| CVE-2022-36983 | 6.3.3.101 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not req | CRITICAL 9.8 | 4.7 % | ||
| CVE-2022-36982 | 6.3.3.101 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authent | HIGH 7.5 | 74 % | ||
| CVE-2022-36981 | 6.3.3.101 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authe | CRITICAL 9.8 | 83 % | ||
| CVE-2022-36980 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authe | CRITICAL 9.4 | 82 % | ||
| CVE-2022-36979 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authe | CRITICAL 9.8 | 6.5 % | ||
| CVE-2022-36978 | 6.3.2.3490 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although auth | CRITICAL 9.8 | 7.3 % | ||
| CVE-2022-36977 | 6.3.2.3490 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although auth | CRITICAL 9.8 | 6.7 % | ||
| CVE-2022-36976 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific f | CRITICAL 9.8 | 6.5 % | ||
| CVE-2022-36975 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific f | CRITICAL 9.8 | 6.5 % | ||
| CVE-2022-36974 | 6.3.2.3490 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although auth | CRITICAL 9.8 | 84 % | ||
| CVE-2022-36973 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authe | CRITICAL 9.1 | 6.0 % | ||
| CVE-2022-36972 | 6.3.2.3490 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific f | CRITICAL 9.8 | 6.5 % | ||
| CVE-2022-36971 | 6.3.2.3490 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although auth | CRITICAL 9.8 | 15 % |