CVE-2022-36975

CVE-2022-36975 affects Ivanti Avalanche 6.3.2.3490. The root cause is a SQL injection in the ProfileDaoImpl class triggered by a crafted request that builds SQL from user-supplied strings, enabling authentication bypass. This is documented across multiple sources (ZDI advisory ZDI-22-780 and ZDI-...

CVE-2022-36982

CVE-2022-36982 affects Ivanti Avalanche 6.3.3.101. The flaw is in the AgentTaskHandler and stems from inadequate validation of a user-supplied path before file operations, enabling a path-traversal-like disclosure of arbitrary files and stored session cookies. Authentication is required to exploi...

CVE-2022-44574

An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port...

CVE-2022-44574

An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port...

Authentication flaw

An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port...

Avalanche 授权问题漏洞

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. Avalanche version 6.3.x and prior versions have a security vulnerability that stems from improper authentication. A...

CVE-2022-44574

An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port...

CVE-2022-44574

Avalanche up to version 6.3.x is affected by an improper authentication vulnerability that allows an unauthenticated attacker to modify properties on a specific port. The CVE (CVE-2022-44574) is corroborated by multiple sources (NVD, Red Hat, CNNVD, CVE list, ZDI advisory) indicating the issue ar...

CVE-2022-44574

An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port...

Ivanti Avalanche Remote Control Server RCServlet Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Remote Control Server RCServlet servlet. The issue results from the lack of...

PT-2023-14507 · Avalanche · Avalanche

Name of the Vulnerable Software and Affected Versions: Avalanche versions 6.3.x and below Description: An improper authentication issue exists, allowing an unauthenticated attacker to modify properties on a specific port. Recommendations: For Avalanche versions 6.3.x and below, update to a versio...

Avalanche ZDI-CAN-19513 Security Advisory

Last Modified Date Apr 3, 2023 8:41:48 PM...

Upgraded Q -> 2 from #214 [1675930440482]

Judge has assessed an item in Issue 214 as 2 risk. The relevant finding follows: cenario 2 - Use node of node operator In this scenario the NodeOp registers for a duration longer then 14 days. The hacker will hijack the minipool after 14 days and earn rewards on behalf of the node operators node...

PT-2022-7216 · Ivanti · Ivanti Avalanche Smart Device Service

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche Smart Device Service affected versions not specified Description: The issue is related to a lack of authentication procedure for a critical function in the Smart Device Service of the Ivanti Avalanche system. Exploitation of...

Ivanti Avalanche Enterprise Service SQL Injection (CVE-2021-42131)

An SQL injection vulnerability exists in the Ivanti Avalanche EnterpriseServer service. The vulnerability is due to insufficient validation of data sent to the EnterpriseServer service...

Ivanti Avalanche Enterprise Service Command Injection (CVE-2021-42129)

A command injection vulnerability exists in Ivanti Avalanche Enterprise Service. This vulnerability is due to insufficient validation of the Central FileStore configuration fields...

Ivanti Avalanche DataRepository Service Insecure Deserialization (CVE-2021-42130)

An insecure deserialization vulnerability exists in the Ivanti Avalanche DataRepository service. The vulnerability is due to insufficient validation of serialized data sent to the DataRepository service...

Ivanti Avalanche EnterpriseServer Service setUser Authentication Bypass (CVE-2021-42128)

A authentication bypass vulnerability exists in the Ivanti Avalanche Enterprise Server. The vulnerability is due to lack of authentication for certain functionality...

Ivanti Avalanche PrinterDeviceServer Service Command Injection (CVE-2021-42132)

A command injection vulnerability exists in Ivanti Avalanche PrinterDeviceServer Service. This vulnerability is due to insufficient input validation in the runAgentRestarter method...

Yield Monitor Integrates The DeFiChain Blockchain Into Its Database

By Owais Sultan The Yield Monitor database already includes various cryptocurrency projects, such as Algorand ALGO, Avalanche AVAX, Binance BNB, Ethereum ETH, Fantom FTM, and Polygon MATIC. This is a post from HackRead.com Read the original post: Yield Monitor Integrates The DeFiChain Blockchain...