CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6368 – WhatsUp Gold Unauthenticated Access to an API Endpoint
https://notcve.org/view.php?id=CVE-2023-6368
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold. En las versiones de WhatsUp Gold lanzadas antes de 2023.1, se descubrió que a un endpoint de API le faltaba un mecanismo de autenticación. Es posible que un atacante no autenticado enumere información relacionada con un dispositivo registrado que está siendo monitorizado por WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6595 – WhatsUp Gold Unauthenticated Access to an API Endpoint
https://notcve.org/view.php?id=CVE-2023-6595
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. En las versiones de WhatsUp Gold lanzadas antes de 2023.1, se descubrió que a un endpoint de API le faltaba un mecanismo de autenticación. Es posible que un atacante no autenticado enumere información de credenciales auxiliares almacenada en WhatsUp Gold. • https://github.com/sharmashreejaa/CVE-2023-6595 https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6367 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
https://notcve.org/view.php?id=CVE-2023-6367
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacenadas. Es posible que un atacante cree un payload XSS y almacene ese valor dentro de Roles. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6366 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
https://notcve.org/view.php?id=CVE-2023-6366
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacenadas. Es posible que un atacante cree un payload XSS y almacene ese valor en el Centro de Alertas. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6365 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
https://notcve.org/view.php?id=CVE-2023-6365
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacenadas. Es posible que un atacante cree un payload XSS y almacene ese valor dentro de un grupo de dispositivos. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •