CVE-2023-46265

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
IvantiAvalanche>= 6.4.1, <= 6.4.1

References

Timeline

Published
Dec 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-462669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.CVE-2023-46274.3The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_config() fCVE-2023-462703.3MacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.CVE-2023-462719.8Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui servCVE-2023-462728.8Buffer Overflow vulnerability in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, allows an attacker to execute CVE-2023-462738.8Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_sCVE-2023-462777.8please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX arCVE-2023-462786.5Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.1.0 to 4.1.1 allows a remote authenticated attacker to consume huCVE-2023-462799.8Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgradCVE-2023-46284.3The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the ladiflow_save_hook() functiCVE-2023-462806.5A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), CVE-2023-462818.8A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATI
CVE-2023-46265: Critical severity, CVSS 9.8 | Vulnix