4472 matches found
CVE-2024-29204
A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands...
CVE-2024-23532
An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. In certain conditions this could also lead to remote code execution...
CVE-2024-23533
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote attacker to read sensitive information in memory...
CVE-2024-24998
CVE-2024-24998 concerns Ivanti Avalanche. Connected sources confirm a Path Traversal vulnerability in the web component of Ivanti Avalanche, prior to version 6.4.3, which allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. The root cause is improper handling/validation...
CVE-2024-27975
An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-27976
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24993
CVE-2024-24993 describes a TOCTOU race condition in the web component of Ivanti Avalanche prior to 6.4.3. An authenticated remote attacker could exploit this to execute arbitrary commands as SYSTEM. Public sources (NVD, Red Hat, ZDI, Nessus plugin) consistently state the vulnerability exists in t...
CVE-2024-24999
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24995
CVE-2024-24995 describes a TOCTOU race condition in the Ivanti Avalanche web component prior to 6.4.3. An authenticated remote attacker can execute arbitrary commands as SYSTEM due to synchronization flaws when accessing a shared resource. Affected product: Ivanti Avalanche web component (version...
CVE-2024-27978
Ivanti Avalanche CVE-2024-27978 is a Null Pointer Dereference in the WLAvalancheService component that allows an authenticated remote attacker to cause a denial-of-service condition. This affects Ivanti Avalanche versions prior to 6.4.3; the issue can be triggered by accessing the WLAvalancheServ...
CVE-2024-27976
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-29204
CVE-2024-29204 is a heap overflow in Ivanti Avalanche’s WLAvalancheService before 6.4.3. The issue allows a remote unauthenticated attacker to execute arbitrary commands. Connected sources confirm the affected product (Ivanti Avalanche) and component (WLAvalancheService) with a user-initiated con...
CVE-2024-23532
Ivanti Avalanche WLAvalancheService (pre-6.4.3) contains an out-of-bounds read in the WLAvalancheService component that can be triggered by an authenticated remote attacker, potentially causing denial-of-service and, under certain conditions, remote code execution. Affected software: Ivanti Avala...
CVE-2024-24994
CVE-2024-24994 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to version 6.4.3. An authenticated remote attacker can exploit this to execute arbitrary commands as SYSTEM. The issue is the result of improper path validation and restricted directory enforcem...
CVE-2024-24991
Ivanti Avalanche contains a Null Pointer Dereference in the WLAvalancheService component (before 6.4.3) that allows an authenticated remote attacker to cause a denial-of-service. Impact is limited to availability (CVE-2024-24991); attack surface includes the WLAvalancheService (default TCP port 1...
CVE-2024-27977
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby leading to Denial-of-Service...
CVE-2024-24992
Ivanti Avalanche pre-6.4.3 has a Path Traversal in the web component that allows an authenticated remote attacker to execute arbitrary commands as SYSTEM. Root cause stated in connected sources as improper validation of a user-supplied path (notably via getAdhocFilePath) leading to traversal into...
CVE-2024-27984
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or cause denial of service...