CVE-2024-37403

Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.

• CWE-22
• CWE-24

• https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-for-Ivanti-Docs-Work-for-AndroidVendor Advisory

Published

Aug 7, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37397An External XML Entity (XXE) vulnerability in the provisioni…8.2
• CVE-2024-37398Insufficient validation in Ivanti Secure Access Client befor…7.8
• CVE-2024-37399A NULL pointer dereference in WLAvalancheService in Ivanti A…7.5
• CVE-2024-3740A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-37400An out of bounds read in Ivanti Connect Secure before versio…7.5
• CVE-2024-37401An out-of-bounds read in IPsec of Ivanti Connect Secure befo…7.5
• CVE-2024-37404Improper Input Validation in the admin portal of Ivanti Conn…8.8
• CVE-2024-37405Livechat messages can be leaked by combining two NoSQL injec…6.5
• CVE-2024-37406In Brave Android prior to v1.67.116, domains in the Brave Sh…7.5
• CVE-2024-37407Libarchive before 3.7.4 allows name out-of-bounds access whe…9.1
• CVE-2024-37408fprintd through 1.94.3 lacks a security attention mechanism,…7.3
• CVE-2024-37409Improper Neutralization of Input During Web Page Generation …5.4