CVE-2024-29848

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298499.8Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.CVE-2024-29858.8A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects the function formQuick CVE-2024-298508.8Veeam Backup Enterprise Manager allows account takeover via NTLM relay.CVE-2024-298517.2Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.CVE-2024-298522.7Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.CVE-2024-298537.8An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.CVE-2024-298559.0Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator CVE-2024-298577.5An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before CVE-2024-298589.8In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.CVE-2024-298599.8In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.CVE-2024-29868.8A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects the function formSetSpeedWan of t CVE-2024-298627.5The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certai