Ivanti Avalanche vulnerabilities, page 3
117 vulnerabilities
Known vulnerabilities in Ivanti Avalanche, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-47011ivantiavalanche
EPSS score56.34%
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive informationCVE-2024-36136ivantiavalancheEPSS score2.19%
An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.CVE-2024-25000ivantiavalancheEPSS score3.05%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-37373ivantiavalancheEPSS score1.56%
Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE.CVE-2024-37399ivantiavalancheEPSS score27.79%
A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.CVE-2024-29204ivantiavalancheEPSS score4.31%
A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commandsCVE-2024-29848ivantiavalancheEPSS score64.42%
An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM.CVE-2024-27977ivantiavalancheEPSS score1.81%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby leading to Denial-of-Service.CVE-2024-27978ivantiavalancheEPSS score1.73%
A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks.CVE-2024-27984ivantiavalancheEPSS score1.76%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or cause denial of service.CVE-2024-27975ivantiavalancheEPSS score2.62%
An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-27976ivantiavalancheEPSS score3.24%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-38653ivantiavalancheEPSS score91.98%
XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.CVE-2024-38652ivantiavalancheEPSS score7.60%
Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of service via arbitrary file deletion.CVE-2024-22061ivantiavalancheEPSS score3.56%
A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commandsCVE-2024-24995ivantiavalancheEPSS score2.37%
A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-24994ivantiavalancheEPSS score68.10%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-24997ivantiavalancheEPSS score3.24%
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-24993ivantiavalancheEPSS score2.37%
A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.CVE-2024-24991ivantiavalancheEPSS score1.73%
A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks.