4456 matches found
CVE-2022-36975
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can...
CVE-2022-36972
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can...
CVE-2022-36981
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2022-36978
Ivanti Avalanche 6.3.2.3490 is affected. The vulnerability resides in the Notification Server service and stems from improper validation of user-supplied data, leading to deserialization of untrusted data and remote code execution in the service account context. Authentication is required to expl...
CVE-2022-36981
CVE-2022-36981 affects Ivanti Avalanche 6.3.3.101. A path traversal flaw in the DeviceLogResource class allows remote code execution by exploiting improper validation of a user-supplied path in file operations. Authentication is required to exploit, but the existing authentication can be bypassed...
CVE-2022-36980
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2022-36980
CVE-2022-36980 affects Ivanti Avalanche 6.3.2.3490. The vulnerability is an authentication bypass in the EnterpriseServer service caused by lack of proper locking during authentication, enabling remote attackers to bypass authentication. Connected sources identify ZDI-22-785 and related advisorie...
Ivanti Avalanche SQL注入漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche version 6.3.2.3490 suffers from a SQL injection vulnerability that stems from a crafted request in...
CVE-2022-36977
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate...
Ivanti Avalanche 路径遍历漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A path traversal vulnerability exists in Ivanti Avalanche version 6.3.3.101, which stems from a failure to properly...
CVE-2022-36977
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate...
Ivanti Avalanche 代码问题漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.2.3490, which stems from a lack of proper...
Ivanti Avalanche 路径遍历漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A path traversal vulnerability exists in Ivanti Avalanche version 6.3.3.101, which stems from a failure to properly...
CVE-2022-36978
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification...
CVE-2022-36971
Ivanti Avalanche 6.3.2.3490 is affected by CVE-2022-36971 due to deserialization of untrusted data in JwtTokenUtility, enabling remote code execution with network access and low attack complexity. Authentication is required but may be bypassed. No official patch/version is stated in the provided ...
CVE-2022-36972
CVE-2022-36972 concerns Ivanti Avalanche 6.3.2.3490. The vulnerability is a SQL injection in the ProfileDaoImpl class that allows a crafted request to assemble and execute SQL from user-supplied input, enabling an authentication bypass over the network. Related disclosures (ZDI-22-777) and vendor...
CVE-2022-36982
CVE-2022-36982 affects Ivanti Avalanche 6.3.3.101. The flaw is in the AgentTaskHandler and stems from inadequate validation of a user-supplied path before file operations, enabling a path-traversal-like disclosure of arbitrary files and stored session cookies. Authentication is required to exploi...
CVE-2022-36975
CVE-2022-36975 affects Ivanti Avalanche 6.3.2.3490. The root cause is a SQL injection in the ProfileDaoImpl class triggered by a crafted request that builds SQL from user-supplied strings, enabling authentication bypass. This is documented across multiple sources (ZDI advisory ZDI-22-780 and ZDI-...
Ivanti Avalanche 代码问题漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.2.3490, which stems from a lack of proper...
Ivanti Avalanche SQL注入漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche version 6.3.2.3490 suffers from a SQL injection vulnerability that stems from a crafted request in...