Ivanti Avalanche
117 CVEs affecting Ivanti Avalanche. Latest disclosed: 2025-08-12. Critical: 43, High: 67.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38036 | Critical | 9.8 | 2025-07-12 | A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could resu… |
CVE-2024-29204 | Critical | 9.8 | 2024-04-19 | A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary co… |
CVE-2024-24996 | Critical | 9.8 | 2024-04-19 | A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary co… |
CVE-2024-22061 | Critical | 9.8 | 2024-04-19 | A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary com… |
CVE-2023-46265 | Critical | 9.8 | 2023-12-19 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). |
CVE-2023-46264 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-46263 | Critical | 9.8 | 2023-12-19 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote… |
CVE-2023-46261 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46260 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46259 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46258 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46257 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46225 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46224 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46223 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46222 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46221 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46220 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46217 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |
CVE-2023-46216 | Critical | 9.8 | 2023-12-19 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c… |