CVE-2021-42126

An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation...

Command injection

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

Unrestricted file upload

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...

Improper access control

An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover...

Deserialization of untrusted data

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution...

Authorization

An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation...

Design/Logic Flaw

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write...

Command injection

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

EUVD-2021-29118

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write...

CVE-2021-42130

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution...

CVE-2021-42129

CVE-2021-42129 affects Ivanti Avalanche prior to 6.3.3. Multiple connected sources describe a command injection/remote code execution vulnerability in Ivanti Avalanche components, with different root causes cited: NVD/NVD entry notes a command execution via Inforail Service; Red Hat advisory refe...

CVE-2021-42129

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42128

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service...

CVE-2021-42125

Summary: CVE-2021-42125 is an unrestricted file upload vulnerability in Ivanti Avalanche, exploitable on versions prior to 6.3.3 when an attacker with access to the Inforail/ FileStore flow can write dangerous files. The Red Hat/NVD entries duplicate the issue description. ZDI’s advisory adds tha...

CVE-2021-42125

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...

CVE-2021-42124

An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover...

PT-2021-23548 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.3.3 Description: An improper access control issue exists, allowing an attacker with access to the Inforail Service to perform a session takeover. Recommendations: For versions prior to 6.3.3, update to...

PT-2021-23550 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.3.3 Description: An improper authorization control issue exists, allowing an attacker with access to the Inforail Service to perform privilege escalation. Recommendations: For versions prior to 6.3.3, upda...