CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-7679 – Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-7679
Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/. Vulnerabilidad de XSS en Ipswitch MOVEit Mobile en versiones anteriores a 1.2.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cadena query a mobile/. Ipswitch MOVEit Mobile versions 1.2.0.962 and below suffer from a reflective cross site scripting vulnerability. • http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf http://packetstormsecurity.com/files/135461/Ipswitch-MOVEit-Mobile-1.2.0.962-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2016/Jan/95 https://profundis-labs.com/advisories/CVE-2015-7679.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7678 – Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-7678
Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de CSRF en Ipswitch MOVEit Mobile 1.2.0.962 y versiones anteriores permiten a atacantes remotos secuestrar la autenticación de víctimas no especificadas a través de vectores desconocidos. Ipswitch MOVEit Mobile versions 1.2.0.962 and below suffer from a cross site request forgery vulnerability. • http://packetstormsecurity.com/files/135460/Ipswitch-MOVEit-Mobile-1.2.0.962-Cross-Site-Request-Forgery.html http://seclists.org/fulldisclosure/2016/Jan/95 https://www.profundis-labs.com/advisories/CVE-2015-7678.txt • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 2CVE-2015-7675 – Ipswitch MOVEit DMZ 8.1 Authorization Bypass
https://notcve.org/view.php?id=CVE-2015-7675
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx. La funcionalidad "Send as attachment" en Ipswitch MOVEit DMZ en versiones anteriores a 8.2 y MOVEit Mobile en versiones anteriores a 1.2.2 permite a usuarios remotos autenticados eludir la autorización y leer archivos cargados a través de un FileID válido en el parámetro (1) serverFileIds en mobile/sendMsg o (2) arg01 en human.aspx. Ipswitch MOVEit DMZ versions 8.1 and below suffer from an authorization bypass vulnerability. • http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf http://packetstormsecurity.com/files/135457/Ipswitch-MOVEit-DMZ-8.1-Authorization-Bypass.html http://seclists.org/fulldisclosure/2016/Jan/95 https://www.profundis-labs.com/advisories/CVE-2015-7675.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •