Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Ivanti Avalanche 6.4.1 Clear all filters
TI-2023-15842 CVE-2023-32560 · GHSA-m39h-xjmq-4vgf

Improper input validation in Ivanti Avalanche

Priority CRITICAL 88

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99401 Published 2023-08-10 Fixed in 6.4.1 CWE-20
TI-2023-15843 CVE-2023-32561 · GHSA-phr8-gxv9-j9vc

Information disclosure in Ivanti Avalanche

Priority MEDIUM 40

A previously generated artifact by an administrator could be accessed by an attacker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02445 Published 2023-08-10 Fixed in 6.4.1 CWE-200
TI-2023-15844 CVE-2023-32562 · GHSA-m9h6-mxp3-hqc9

Unrestricted file upload in Ivanti Avalanche

Priority HIGH 72

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.45562 Published 2023-08-10 Fixed in 6.4.1 CWE-434
TI-2023-15846 CVE-2023-32564 · GHSA-pxwm-4jgh-gv2g

Unrestricted file upload in Ivanti Avalanche

Priority HIGH 72

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.44427 Published 2023-08-10 Fixed in 6.4.1 CWE-434