CVE-2021-42129

CVE-2021-42129 affects Ivanti Avalanche prior to 6.3.3. Multiple connected sources describe a command injection/remote code execution vulnerability in Ivanti Avalanche components, with different root causes cited: NVD/NVD entry notes a command execution via Inforail Service; Red Hat advisory refe...

CVE-2021-42128

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service...

CVE-2021-42125

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...

CVE-2021-42125

Summary: CVE-2021-42125 is an unrestricted file upload vulnerability in Ivanti Avalanche, exploitable on versions prior to 6.3.3 when an attacker with access to the Inforail/ FileStore flow can write dangerous files. The Red Hat/NVD entries duplicate the issue description. ZDI’s advisory adds tha...

CVE-2021-42124

An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover...

CVE-2021-42132: Improper Neutralization of Special Elements used in a Command

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42128: Exposed Dangerous Method or Function

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via Enterprise Server Service...

CVE-2021-42126: Improper Authorization

An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation...

CVE-2021-42130: Deserialization of Untrusted Data

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution...

CVE-2021-42127: Deserialization of Untrusted Data

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service...

CVE-2021-42131: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation...

CVE-2021-42133: Unrestricted Upload of File with Dangerous Type

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitrary file write...

CVE-2021-42129: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42124: Improper Access Control

An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform a session takeover...

CVE-2021-42125: Deserialization of Untrusted Data

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files...

PT-2021-23549

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.3.3 Description An unrestricted file upload vulnerability exists, allowing an attacker with access to the Inforail Service to write dangerous files. This issue can potentially lead to remote code execution...

PT-2021-23551

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.3.3 Description A SQL Injection issue exists, allowing an attacker with access to the Inforail Service to perform privilege escalation. Recommendations For versions prior to 6.3.3, update to version 6.3.3 o...

PT-2021-23548 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.3.3 Description: An improper access control issue exists, allowing an attacker with access to the Inforail Service to perform a session takeover. Recommendations: For versions prior to 6.3.3, update to...

PT-2021-23552

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.3.3 Description An exposed dangerous function vulnerability exists, allowing an attacker with access to the Inforail Service to perform an arbitrary file write. This issue affects Ivanti Avalanche and can b...

PT-2021-23550 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.3.3 Description: An improper authorization control issue exists, allowing an attacker with access to the Inforail Service to perform privilege escalation. Recommendations: For versions prior to 6.3.3, upda...