AV
Product
Avalanche
117
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 47High 63Medium 7Low 0
Watch
Add Avalanche to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-28127 | 7.5 | May 9 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure Affected: through 6.3.4.153 |
| CVE-2022-36982 | 7.5 | Mar 29 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101 Affected: 6.3.3.101 before 6.3.4 |
| CVE-2022-44574 | 7.5 | Mar 10 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port Affected: before 6.4.0 |
| CVE-2021-30497 | 7.5 | Apr 6 | Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal Affected: 6.3.2 |
| CVE-2025-8297 | 7.2 | Aug 12 | Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution Affected: before 6.4.8.8008 |
| CVE-2025-8296 | 7.2 | Aug 12 | SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries Affected: before 6.4.8.8008 |
| CVE-2024-37373 | 7.2 | Aug 14 | Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated attacker with admin rights to achieve RCE Affected: 6.3.1; 6.3.1.1507; 6.3.2; 6.3.2; 6.3.2; 6.3.2.3490; +14 more |
| CVE-2024-29848 | 7.2 | May 31 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM Affected: before 6.4.3.602 |
| CVE-2023-28128 | 7.2 | May 9 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution Affected: through 6.3.4.153 |
| CVE-2024-27984 | 7.1 | Apr 19 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to delete specific type of files and/or cause denial of… Affected: before 6.4.3.528 |
| CVE-2024-27978 | 6.5 | Apr 19 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service… Affected: before 6.4.3.528 |
| CVE-2024-24991 | 6.5 | Apr 19 | A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service… Affected: before 6.4.3.528 |
| CVE-2024-23533 | 6.5 | Apr 19 | An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote attacker to read… Affected: before 6.4.3.528 |
| CVE-2023-41474 | 6.5 | Jan 25 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component Affected: 6.3.4.153 |
| CVE-2018-8902 | 6.5 | Jun 29 | An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2 Affected: 5.3 through 6.2 |
| CVE-2023-28126 | 5.9 | May 9 | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the… Affected: through 6.3.4.153 |
| CVE-2023-28125 | 5.9 | May 9 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive… Affected: through 6.3.4.153 |