High WID-SEC-2024-0900 27 CVEs

Ivanti Avalanche: Mehrere Schwachstellen

Published Apr 16, 2024 · Updated Apr 16, 2024 · de-DE

Vendor: ivanti Product: Avalanche Platform: Windows

Summary

Ein entfernter authentifizierter oder anonymer Angreifer kann mehrere Schwachstellen in Ivanti Avalanche ausnutzen, um beliebigen Code im Kontext des Dienstes auszuführen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.

Product

Ivanti Avalanche ist eine Mobile Device Management Lösung.

Vulnerabilities 27

Critical 9.8

CVE-2024-24996 EPSS 32%

A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated…

ivanti Avalanche Network devices

Apr 19, 2024
Critical 9.8

CVE-2024-29204

A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthen…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-23534

An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticat…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-23535 EPSS 68%

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24992 EPSS 71%

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24993

A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24994 EPSS 68%

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24995

A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24997

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24998

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-24999

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avlanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-25000

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-27975

An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authen…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.8

CVE-2024-27976

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 8.1

CVE-2024-22061

A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthent…

ivanti Avalanche Network devices

Apr 19, 2024
High 7.5

CVE-2024-23531

An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthentic…

ivanti Avalanche Network devices

Apr 19, 2024
High 7.5

CVE-2024-23532

An out-of-bounds Read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenti…

ivanti Avalanche Network devices

Apr 19, 2024
High 7.1

CVE-2024-27977

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
High 7.1

CVE-2024-27984

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 6.5

CVE-2024-24991

A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an aut…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 6.5

CVE-2024-27978

A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an aut…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 5.3

CVE-2024-23526

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 5.3

CVE-2024-23527

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 24, 2024
Medium 5.3

CVE-2024-23528

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 5.3

CVE-2024-23529

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 5.3

CVE-2024-23530

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 19, 2024
Medium 4.3

CVE-2024-23533

An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain condit…

ivanti Avalanche Network devices

Apr 19, 2024

Revision history

2024-04-16 #1
Initiale Fassung

References

Ivanti Avalanche Release Notes vom 2024-04-16
https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed