Avalanche
Products
3- 8 CVEs
- 7 CVEs
- 1 CVE
Recent CVEs
16| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-46264 | Cri | 0.71 | 9.8 | 0.90 | Dec 19, 2023 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. | ||
| CVE-2023-46263 | Cri | 0.70 | 9.8 | 0.82 | Dec 19, 2023 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution. | ||
| CVE-2023-46217 | Cri | 0.67 | 9.8 | 0.36 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2023-32564 | Cri | 0.67 | 9.8 | 0.44 | Aug 10, 2023 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. | ||
| CVE-2023-32562 | Cri | 0.67 | 9.8 | 0.46 | Aug 10, 2023 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1. | ||
| CVE-2021-22962 | Cri | 0.66 | 9.1 | 0.91 | Dec 19, 2023 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. | ||
| CVE-2023-46261 | Cri | 0.65 | 9.8 | 0.11 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2023-46220 | Cri | 0.65 | 9.8 | 0.11 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2023-46265 | Cri | 0.64 | 9.8 | 0.04 | Dec 19, 2023 | An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). | ||
| CVE-2023-46223 | Cri | 0.64 | 9.8 | 0.07 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2023-46222 | Cri | 0.64 | 9.8 | 0.07 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2023-46221 | Cri | 0.64 | 9.8 | 0.07 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution. | ||
| CVE-2022-44574 | Hig | 0.54 | 7.5 | 0.65 | Mar 10, 2023 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. | ||
| CVE-2023-46804 | Hig | 0.49 | 7.5 | 0.04 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). | ||
| CVE-2023-46803 | Hig | 0.49 | 7.5 | 0.04 | Dec 19, 2023 | An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS). | ||
| CVE-2023-28125 | Med | 0.39 | 5.9 | 0.02 | May 9, 2023 | An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass. |
- risk 0.71cvss 9.8epss 0.90
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
- risk 0.70cvss 9.8epss 0.82
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.
- risk 0.67cvss 9.8epss 0.36
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.67cvss 9.8epss 0.44
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.
- risk 0.67cvss 9.8epss 0.46
An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. Fixed in version 6.4.1.
- risk 0.66cvss 9.1epss 0.91
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.
- risk 0.65cvss 9.8epss 0.11
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.65cvss 9.8epss 0.11
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.64cvss 9.8epss 0.04
An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).
- risk 0.64cvss 9.8epss 0.07
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.64cvss 9.8epss 0.07
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.64cvss 9.8epss 0.07
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
- risk 0.54cvss 7.5epss 0.65
An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.
- risk 0.49cvss 7.5epss 0.04
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
- risk 0.49cvss 7.5epss 0.04
An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS).
- risk 0.39cvss 5.9epss 0.02
An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass.