CVE-2024-29204

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-292057.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P CVE-2024-292062.2An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported CVE-2024-292077.5An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affe CVE-2024-292082.2An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the CVE-2024-292096.0A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an atta CVE-2024-29219.8Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t CVE-2024-292102.8A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its config CVE-2024-292114.7A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratio CVE-2024-292129.9Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management ag CVE-2024-292137.8Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via uns CVE-2024-292147.5Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially ena CVE-2024-292154.3Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a use