CVE-2024-23535

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-27975

An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23530

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory...

CVE-2024-23530

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory...

CVE-2024-24997

Ivanti Avalanche (web component) prior to version 6.4.3 is affected by a Path Traversal vulnerability that allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Root cause: improper validation of user-supplied paths in the WLAvalancheService/web component. Affected: Ivan...

CVE-2024-24997

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24994

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23533

CVE-2024-23533 describes an out-of-bounds read in Ivanti Avalanche’s WLAvalancheService, affecting versions prior to 6.4.3. An authenticated remote attacker could read sensitive information from memory under certain conditions. The linked documents confirm the vulnerable component and version bou...

CVE-2024-24993

CVE-2024-24993 describes a TOCTOU race condition in the web component of Ivanti Avalanche prior to 6.4.3. An authenticated remote attacker could exploit this to execute arbitrary commands as SYSTEM. Public sources (NVD, Red Hat, ZDI, Nessus plugin) consistently state the vulnerability exists in t...

CVE-2024-27977

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete arbitrary files, thereby leading to Denial-of-Service...

CVE-2024-24993

A Race Condition TOCTOU vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23535

CVE-2024-23535 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to 6.4.3. An authenticated remote attacker can exploit an insufficiently restricted pathname in the web component to execute arbitrary commands as SYSTEM. Root cause cited in connected sources i...

CVE-2024-27975

CVE-2024-27975 : Ivanti Avalanche’s WLAvalancheService (on Ivanti Avalanche before 6.4.3) suffers a use-after-free that can allow a remote authenticated attacker to execute arbitrary commands as SYSTEM. The vulnerability enables remote code execution and is associated with the service listening b...

CVE-2024-27976

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24994

CVE-2024-24994 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to version 6.4.3. An authenticated remote attacker can exploit this to execute arbitrary commands as SYSTEM. The issue is the result of improper path validation and restricted directory enforcem...

CVE-2024-27976

CVE-2024-27976 describes a path traversal vulnerability in the Ivanti Avalanche web component prior to version 6.4.3 . An authenticated remote attacker can abuse the vulnerable web component to execute arbitrary commands as the SYSTEM user. The issue is addressed by upgrading to Ivanti Avalanche ...

CVE-2024-23532

Ivanti Avalanche WLAvalancheService (pre-6.4.3) contains an out-of-bounds read in the WLAvalancheService component that can be triggered by an authenticated remote attacker, potentially causing denial-of-service and, under certain conditions, remote code execution. Affected software: Ivanti Avala...

CVE-2024-24991

Ivanti Avalanche contains a Null Pointer Dereference in the WLAvalancheService component (before 6.4.3) that allows an authenticated remote attacker to cause a denial-of-service. Impact is limited to availability (CVE-2024-24991); attack surface includes the WLAvalancheService (default TCP port 1...

CVE-2024-24995

CVE-2024-24995 describes a TOCTOU race condition in the Ivanti Avalanche web component prior to 6.4.3. An authenticated remote attacker can execute arbitrary commands as SYSTEM due to synchronization flaws when accessing a shared resource. Affected product: Ivanti Avalanche web component (version...

Ivanti Avalanche 安全漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche prior to version 6.4.3, which stems from a use-after-release...