CVE-2023-28128

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-281297.8DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatioCVE-2023-28136.1All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPrCVE-2023-281307.2Local user may lead to privilege escalation using Gaia Portal hostnames page.CVE-2023-281319.6A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confiCVE-2023-281337.8Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration fileCVE-2023-281347.8Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker musCVE-2023-28146.1A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of tCVE-2023-281407.0An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malCVE-2023-281416.3An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to aCVE-2023-281427.0A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers tCVE-2023-281437.0Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of insCVE-2023-281447.0KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving
CVE-2023-28128: High severity, CVSS 7.2 | Vulnix