CVE-2024-27977

The CVE-2024-27977 issue is a Path Traversal vulnerability in the Ivanti Avalanche web component, prior to version 6.4.3. An authenticated remote attacker can delete arbitrary files on affected installations, leading to a Denial-of-Service. Root cause: insufficient validation of user-supplied pat...

CVE-2024-24998

CVE-2024-24998 concerns Ivanti Avalanche. Connected sources confirm a Path Traversal vulnerability in the web component of Ivanti Avalanche, prior to version 6.4.3, which allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. The root cause is improper handling/validation...

CVE-2024-23535

CVE-2024-23535 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to 6.4.3. An authenticated remote attacker can exploit an insufficiently restricted pathname in the web component to execute arbitrary commands as SYSTEM. Root cause cited in connected sources i...

CVE-2024-24999

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24991

Ivanti Avalanche contains a Null Pointer Dereference in the WLAvalancheService component (before 6.4.3) that allows an authenticated remote attacker to cause a denial-of-service. Impact is limited to availability (CVE-2024-24991); attack surface includes the WLAvalancheService (default TCP port 1...

CVE-2024-24994

CVE-2024-24994 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to version 6.4.3. An authenticated remote attacker can exploit this to execute arbitrary commands as SYSTEM. The issue is the result of improper path validation and restricted directory enforcem...

CVE-2024-24992

Ivanti Avalanche pre-6.4.3 has a Path Traversal in the web component that allows an authenticated remote attacker to execute arbitrary commands as SYSTEM. Root cause stated in connected sources as improper validation of a user-supplied path (notably via getAdhocFilePath) leading to traversal into...

CVE-2024-23533

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote attacker to read sensitive information in memory...

CVE-2024-24996

A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands...

CVE-2024-24997

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23535

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23534

An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24995

CVE-2024-24995 describes a TOCTOU race condition in the Ivanti Avalanche web component prior to 6.4.3. An authenticated remote attacker can execute arbitrary commands as SYSTEM due to synchronization flaws when accessing a shared resource. Affected product: Ivanti Avalanche web component (version...

CVE-2024-27975

CVE-2024-27975 : Ivanti Avalanche’s WLAvalancheService (on Ivanti Avalanche before 6.4.3) suffers a use-after-free that can allow a remote authenticated attacker to execute arbitrary commands as SYSTEM. The vulnerability enables remote code execution and is associated with the service listening b...

CVE-2024-29204

CVE-2024-29204 is a heap overflow in Ivanti Avalanche’s WLAvalancheService before 6.4.3. The issue allows a remote unauthenticated attacker to execute arbitrary commands. Connected sources confirm the affected product (Ivanti Avalanche) and component (WLAvalancheService) with a user-initiated con...

CVE-2024-23532

An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. In certain conditions this could also lead to remote code execution...

CVE-2024-27984

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or cause denial of service...

CVE-2024-24994

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-29204

A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands...

CVE-2024-27984

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or cause denial of service...