CVE-2022-36981

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-36980

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2022-36975

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can...

CVE-2022-36980

CVE-2022-36980 affects Ivanti Avalanche 6.3.2.3490. The vulnerability is an authentication bypass in the EnterpriseServer service caused by lack of proper locking during authentication, enabling remote attackers to bypass authentication. Connected sources identify ZDI-22-785 and related advisorie...

CVE-2022-36981

CVE-2022-36981 affects Ivanti Avalanche 6.3.3.101. A path traversal flaw in the DeviceLogResource class allows remote code execution by exploiting improper validation of a user-supplied path in file operations. Authentication is required to exploit, but the existing authentication can be bypassed...

CVE-2022-36978

Ivanti Avalanche 6.3.2.3490 is affected. The vulnerability resides in the Notification Server service and stems from improper validation of user-supplied data, leading to deserialization of untrusted data and remote code execution in the service account context. Authentication is required to expl...

CVE-2022-36983

Ivanti Avalanche is affected by an authentication bypass in the SetSettings class. The issue allows remote attackers with network access to bypass authentication and access features without prior login. The core detail across sources is that the vulnerability stems from lack of authentication bef...

CVE-2022-36977

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate...

Ivanti Avalanche 路径遍历漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A path traversal vulnerability exists in Ivanti Avalanche version 6.3.3.101, which stems from a failure to properly...

CVE-2022-36978

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification...

Ivanti Avalanche SQL注入漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. An SQL injection vulnerability exists in Ivanti Avalanche version 6.3.2.3490. An attacker could exploit this...

Ivanti Avalanche 代码问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.2.3490, which stems from a lack of proper...

Ivanti Avalanche 路径遍历漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A path traversal vulnerability exists in Ivanti Avalanche version 6.3.3.101, which stems from a failure to properly...

CVE-2022-36977

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate...

Ivanti Avalanche 代码问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A code issue vulnerability exists in Ivanti Avalanche version 6.3.2.3490, which stems from a lack of proper...

Ivanti Avalanche SQL注入漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche version 6.3.2.3490 suffers from a SQL injection vulnerability that stems from a crafted request in...

CVE-2022-36976

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the GroupDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can levera...

CVE-2022-36972

CVE-2022-36972 concerns Ivanti Avalanche 6.3.2.3490. The vulnerability is a SQL injection in the ProfileDaoImpl class that allows a crafted request to assemble and execute SQL from user-supplied input, enabling an authentication bypass over the network. Related disclosures (ZDI-22-777) and vendor...

Ivanti Avalanche SQL注入漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Ivanti Avalanche version 6.3.2.3490 suffers from a SQL injection vulnerability that stems from a crafted request in...

CVE-2022-36971

Ivanti Avalanche 6.3.2.3490 is affected by CVE-2022-36971 due to deserialization of untrusted data in JwtTokenUtility, enabling remote code execution with network access and low attack complexity. Authentication is required but may be bypassed. No official patch/version is stated in the provided ...