CVE-2023-32564

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

CVE-2023-32567

Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236...

CVE-2023-32567

Ivanti Avalanche contains an XXE-related vulnerability in the decodeToMap XML processing, enabling potential information disclosure in affected installations. The issue stems from improper handling of XML External Entity references within the decodeToMap method. Public advisories (ZDI-23-1167) de...

Ivanti Avalanche Code Issue Vulnerability

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche has a code issue vulnerability that originates from a sensitive data disclosure in the decodeToMap...

PT-2023-23876 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.1 Description: An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Recommendations: For versions prior to 6.4.1,...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.1.207 that stems from an authentication...

PT-2023-23878 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.1.236 Description: The issue concerns XML External Entity Processing in the decodeToMap function of Ivanti Avalanche, which can lead to information disclosure. Recommendations: For versions prior to...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche 6.4.0 and earlier versions, which stems from an authentication...

Ivanti Avalanche Code Issue Vulnerability

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.1.207 that stems from unrestricted file...

PT-2023-23874 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An unrestricted upload of file with a dangerous type could allow an attacker to achieve remote code execution. The issue is fixed in version 6.4.1. Recommendations: For Avalanche versions 6.3.x...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.1.207, which stems from a sensitive data...

Ivanti Avalanche Buffer Error Vulnerability

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche version 6.4.0 and earlier, which stems from an authentication...

Ivanti Avalanche Path Traversal Vulnerability

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.1.207, which stems from the inclusion of...

Ivanti Avalanche Code Issue Vulnerability

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche versions prior to 6.4.1.207 that stems from unrestricted file...

Avalanche Vulnerabilities Addressed in 6.4.1

Securtiy Advisory for Avalanche 6.4 and older. To resolve these vulnerabilities, please upgrade to Avalanche 6.4.1.207 Download Page: https://www.wavelink.com/Download-AvalancheMobile-Device-Management-Software/ Release Notes:...

looper.avalanche.state.co.us Cross Site Scripting vulnerability OBB-3559030

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-8010 · Ivanti · Ivanti Avalanche Enterpriseserver Service

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche EnterpriseServer Service affected versions not specified Description: The issue is related to an unrestricted file upload vulnerability in the Ivanti Avalanche EnterpriseServer Service, which can be exploited to elevate...

Ivanti Avalanche FileStoreConfig Shell Upload Exploit

Ivanti Avalanche versions prior to 6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve remote command execution as NT...

Ivanti Avalanche FileStoreConfig File Upload

Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the configuration path for the Central FileStore. Because of this, an administrator can change the default path to the web root of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM. Module Options m...