Ivanti Avalanche

• CVE-2023-46261 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 11.3%
• CVE-2023-46266 High 7.3 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. 3.5%
• CVE-2023-46260 High 7.5 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 9.8%
• CVE-2023-46258 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 6.8%
• CVE-2023-46803 High 7.5 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). 4.1%
• CVE-2023-46264 High 7.2 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. 90.2%
• CVE-2023-46224 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 6.8%
• CVE-2023-46262 High 7.5 An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server. 82.8%
• CVE-2023-46221 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 6.8%
• CVE-2023-46222 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 6.8%
• CVE-2023-46265 Medium 6.5 An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). 4.0%
• CVE-2023-46257 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 11.3%
• CVE-2023-46804 High 7.5 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). 4.1%
• CVE-2023-46263 High 7.2 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution. 81.9%
• CVE-2023-46225 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 11.3%
• CVE-2023-46259 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 11.3%
• CVE-2023-46223 Critical 9.8 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. 6.8%
• CVE-2021-22962 High 7.3 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. 91.0%
• CVE-2023-41726 High 7.8 Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability 0.6%
• CVE-2023-41725 High 7.8 Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability 0.6%
• CVE-2022-43554 High 7.8 Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability 0.5%
• CVE-2022-43555 High 7.8 Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability 0.5%
• CVE-2023-32560 High 8.8 An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding 99.4%
• CVE-2023-32561 High 7.1 A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1. 2.4%
• CVE-2023-32562 Medium 6.8 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1. 45.6%
• CVE-2023-32563 High 8.8 An unauthenticated attacker could achieve the code execution through a RemoteControl server. 89.1%
• CVE-2023-32564 Medium 6.8 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. 44.4%
• CVE-2023-32565 Medium 6.3 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1. 2.2%
• CVE-2023-32566 Medium 6.3 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1. 2.4%
• CVE-2022-36979 High 7.5 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the exi 6.5%
• CVE-2022-36974 Critical 9.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the ex 84.5%
• CVE-2022-36983 High 7.5 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exist 4.7%
• CVE-2022-36973 Critical 9.1 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the exi 6.0%
• CVE-2022-36981 High 8.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the exi 83.4%
• CVE-2022-36976 Critical 9.1 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the GroupDaoImpl class. A crafted request 6.5%
• CVE-2022-36980 Critical 9.4 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the exi 82.4%
• CVE-2022-36978 Critical 9.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the ex 7.3%
• CVE-2022-36972 Critical 9.1 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted reques 6.5%
• CVE-2022-36977 Critical 9.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the ex 6.7%
• CVE-2022-36975 Critical 9.1 This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted reques 6.5%
• CVE-2022-36982 Medium 6.5 This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the exist 73.8%
• CVE-2022-36971 Critical 9.8 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the ex 15.0%