CVE-2023-32560

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.

Thanks to a Researcher at Tenable for finding and reporting.

Fixed in version 6.4.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-325617.5A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authenticaCVE-2023-325629.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker tCVE-2023-325639.8An unauthenticated attacker could achieve the code execution through a RemoteControl server.CVE-2023-325649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker tCVE-2023-325659.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. FCVE-2023-325669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. FCVE-2023-325679.8Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236CVE-2023-325687.2An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application doeCVE-2023-325699.8An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web appliCVE-2023-325705.9VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.CVE-2023-325719.8Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods inCVE-2023-325724.9A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and