ZDI-24-379: Ivanti Avalanche getMasterAdhocCollectionsPath Unrestricted File Upload Remote Code Execution Vulnerability | allinfosecnews.com

April 23, 2024, 5 a.m. |

ZDI: Published Advisories www.zerodayinitiative.com

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-23534.

arbitrary code attackers authentication avalanche code code execution cve cve-2024 cves cvss exploit file file upload ivanti ivanti avalanche rating remote code remote code execution upload vulnerability zdi

More from www.zerodayinitiative.com / ZDI: Published Advisories

ZDI-24-419: (Pwn2Own) Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability 4 days, 8 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +18

ZDI-24-418: (Pwn2Own) Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability 4 days, 8 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +18

ZDI-24-417: Xiaomi Pro 13 isUrlMatchLevel Permissive List of Allowed Inputs Remote Code Execution Vulnerability 4 days, 8 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +16

ZDI-24-416: Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability 6 days, 8 hours ago | www.zerodayinitiative.com

arbitrary code attackers centreon code +12

ZDI-24-407: X.Org Server ProcRenderAddGlyphs Use-After-Free Local Privilege Escalation Vulnerability 1 week, 2 days ago | www.zerodayinitiative.com

attacker attackers code cve +23

ZDI-24-406: Adobe After Effects AEP File Parsing Use-After-Free Remote Code Execution Vulnerability 1 week, 2 days ago | www.zerodayinitiative.com

adobe adobe after effects aep after effects +18

ZDI-24-405: Lexmark CX331adwe IPP Server Authorization HTTP Header Heap-Based Buffer Overflow Remote Code Execution Vulnerability 1 week, 2 days ago | www.zerodayinitiative.com

arbitrary code attackers authentication authorization +20

ZDI-24-415: (Pwn2Own) Oracle VirtualBox E1000 Uninitialized Memory Information Disclosure Vulnerability 1 week, 2 days ago | www.zerodayinitiative.com

attacker attackers code cves +22

ZDI-24-414: (Pwn2Own) Oracle VirtualBox AHCI Controller Uninitialized Memory Information Disclosure Vulnerability 1 week, 2 days ago | www.zerodayinitiative.com

attacker attackers code controller +22

Sr Cyber Threat Hunt Researcher

@ Peraton | Beltsville, MD, United States

View on infosec-jobs.com

Lead Consultant, Hydrogeologist

@ WSP | Chattanooga, TN, United States

View on infosec-jobs.com

Senior Security Engineer - Netskope/Proofpoint

@ Sainsbury's | London, London, United Kingdom

View on infosec-jobs.com

Senior Technical Analyst-Network Security

@ Computacenter | Bengaluru Bengaluru (Bengaluru, IN, 560025

View on infosec-jobs.com

Senior DevSecOps Engineer - Clearance Required

@ Logistics Management Institute | Remote, United States

View on infosec-jobs.com

Software Test Automation Manager - Cloud Security

@ Tenable | Israel - Office - CS

View on infosec-jobs.com