CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2024-13181 – Ivanti Avalanche SecureFilter allowPassThrough Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-13181
14 Jan 2025 — Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010. This vulnerability allows remote attackers to partially bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the allowPassThrough method. The issue results from incorrect string matching when making a... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-13180 – Ivanti Avalanche Faces ResourceManager Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-13180
14 Jan 2025 — Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Faces Mojarra component. The issue results from the use of a vulnerable third-party library. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2024-13179 – Ivanti Avalanche SecureFilter Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-13179
14 Jan 2025 — Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This vulnerability allows remote attackers to partially bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecureFilter class. The issue results from incorrect string matching when making an authorization decision. An attacker can leverage this vulnerability to partially b... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.8EPSS: 3%CPEs: 1EXPL: 0CVE-2024-50331
https://notcve.org/view.php?id=CVE-2024-50331
12 Nov 2024 — An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information in memory. • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-50321 – Ivanti Avalanche WLAvalancheService TV_FP Infinite Loop Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-50321
12 Nov 2024 — An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService service, which listens on TCP port 1777 by default. The issue results from a lack of a proper exit condition in a loop. An attacker can leverage... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-50320 – Ivanti Avalanche WLAvalancheService TV_FC Infinite Loop Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-50320
12 Nov 2024 — An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService service, which listens on TCP port 1777 by default. The issue results from a lack of a proper exit condition in a loop. An attacker can leverage... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2024-50319 – Ivanti Avalanche WLAvalancheService TV_FN Infinite Loop Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-50319
12 Nov 2024 — An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService service, which listens on TCP port 1777 by default. The issue results from a lack of a proper exit condition in a loop. An attacker can leverage... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-50318 – Ivanti Avalanche WLAvalancheService TV_FP Null Pointer Dereference Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-50318
12 Nov 2024 — A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService service, which listens on TCP port 1777 by default. The issue results from dereferencing a null pointer. An attacker can leverage this... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-50317 – Ivanti Avalanche WLAvalancheService TV_FN Null Pointer Dereference Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-50317
12 Nov 2024 — A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService service, which listens on TCP port 1777 by default. The issue results from dereferencing a null pointer. An attacker can leverage this... • https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 3%CPEs: 1EXPL: 0CVE-2024-47007
https://notcve.org/view.php?id=CVE-2024-47007
08 Oct 2024 — A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to cause a denial of service. • https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory • CWE-476: NULL Pointer Dereference •