Avalanche vulnerabilities
71 known vulnerabilities in Avalanche from Ivanti. 71 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Wavelink: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Wavelink: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Wavelink: Out-of-bounds Write
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- 9.8 Critical severity
Avalanche: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
- 9.8 Critical severity
Avalanche: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.
- 7.5 High severity
Avalanche: Exposure of Sensitive Information to an Unauthorized Actor
A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
- 9.8 Critical severity
Avalanche: Out-of-bounds Write
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.
- 9.8 Critical severity
Avalanche: Missing Authentication for Critical Functionality
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetSettings class. The issue results from the l
- 7.5 High severity
Avalanche: Improper Limitation of a Pathname to a Restricted Directory
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific f
- 9.8 Critical severity
Avalanche: Improper Limitation of a Pathname to a Restricted Directory
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific
- 8.1 High severity
Avalanche: Time-of-check Time-of-use (TOCTOU) Race Condition
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific
- 9.8 Critical severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific
- 9.8 Critical severity
Avalanche: Deserialization of Untrusted Data
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specifi
- 9.8 Critical severity
Avalanche: Deserialization of Untrusted Data
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specifi
- 9.8 Critical severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the GroupDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-su
- 9.8 Critical severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-
- 9.8 Critical severity
Avalanche: Deserialization of Untrusted Data
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specifi
- 8.8 High severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific
- 9.8 Critical severity
Avalanche: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-
- 8.8 High severity
Avalanche: Deserialization of Untrusted Data
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specifi
- 7.5 High severity
Ivanti Avalanche: Improper Authentication
An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.