CVE-2018-8902

An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt data. A user with access to system databases can use the discovered key to access potentially confidential stored data, which may include Wi-Fi passwords. This discovered key can be used for all instances of the product.

• CWE-287

• https://community.ivanti.com/docs/DOC-68406Vendor Advisory
• https://community.ivanti.com/docs/DOC-68406Vendor Advisory

Published

Jun 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8896In 2345 Security Guard 3.6, the driver file (2345DumpBlock.s…
• CVE-2018-8897A statement in the System Programming Guide of the Intel 64 …
• CVE-2018-8898A flaw in the authentication mechanism in the Login Panel of…
• CVE-2018-8899IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x befo…
• CVE-2018-8900The License Manager service of HASP SRM, Sentinel HASP and S…
• CVE-2018-8901An issue was discovered in Ivanti Avalanche for all versions…
• CVE-2018-8903Open-AudIT Professional 2.1 allows XSS via the Name or Descr…
• CVE-2018-8904In Windows Master (aka Windows Optimization Master) 7.99.13.…
• CVE-2018-8905In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the…8.8
• CVE-2018-8906dsmall v20180320 has XSS via a crafted street address to pub…
• CVE-2018-8908An issue was discovered in /admin/?/user/add in Frog CMS 0.9…
• CVE-2018-8909The Wire application before 2018-03-07 for Android allows at…