Ivanti Avalanche vulnerabilities, page 5
117 vulnerabilities
Known vulnerabilities in Ivanti Avalanche, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-41474ivantiavalanche
EPSS score37.61%
Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component.CVE-2023-41727ivantiavalanche+1EPSS score36.39%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-41725ivantiavalancheEPSS score0.69%
Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation VulnerabilityCVE-2023-41726ivantiavalancheEPSS score0.60%
Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation VulnerabilityCVE-2023-46264ivantiavalancheEPSS score90.19%
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.CVE-2023-46261ivantiavalancheEPSS score11.34%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46804ivantiavalancheEPSS score4.15%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).CVE-2023-46263ivantiavalancheEPSS score81.88%
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.CVE-2023-46260ivantiavalancheEPSS score9.84%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46266ivantiavalancheEPSS score3.45%
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-46265ivantiavalancheEPSS score4.00%
An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).CVE-2023-46225ivantiavalancheEPSS score11.34%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46224ivantiavalancheEPSS score6.78%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46258ivantiavalancheEPSS score6.78%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46257ivantiavalancheEPSS score11.34%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46259ivantiavalancheEPSS score11.34%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46262ivantiavalancheEPSS score82.85%
An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.CVE-2023-46803ivantiavalancheEPSS score4.15%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).CVE-2023-46217ivantiavalanche+1EPSS score36.39%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.CVE-2023-46220ivantiavalancheEPSS score11.34%
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.