CVE-2023-46264

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Ivanti	Avalanche	>= 6.4.1, <= 6.4.1
ivanti	avalanche	<= 6.4.1

References

https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txtRelease Notes, Vendor Advisory
https://download.wavelink.com/Files/avalanche_v6.4.2_release_notes.txtRelease Notes, Vendor Advisory

Timeline

Published: Dec 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462659.8An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).CVE-2023-462669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-46274.3The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() f CVE-2023-462703.3MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.CVE-2023-462719.8Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui serv CVE-2023-462728.8Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute CVE-2023-462738.8Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_s CVE-2023-462777.8please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX ar CVE-2023-462786.5Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume hu CVE-2023-462799.8Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrad CVE-2023-46284.3The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() functi CVE-2023-462806.5A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2),