CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4332 – Improper Authentication in Tripwire Enterprise 9.1.0 APIs
https://notcve.org/view.php?id=CVE-2024-4332
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification. Se ha identificado una vulnerabilidad de omisión de autenticación en los componentes API REST y SOAP de Tripwire Enterprise (TE) 9.1.0 cuando TE está configurado para usar autenticación SAML LDAP/Active Directory y su opción "Sincronizar automáticamente usuarios, roles y grupos LDAP" La función está habilitada. Esta vulnerabilidad permite a atacantes no autenticados eludir la autenticación si conocen un nombre de usuario válido. • https://www.fortra.com/security/advisory/fi-2024-006 • CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0259 – Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04
https://notcve.org/view.php?id=CVE-2024-0259
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges. El Robot Schedule Enterprise Agent de Fortra para Windows anterior a la versión 3.04 es susceptible a una escalada de privilegios. Un usuario con pocos privilegios puede sobrescribir el ejecutable del servicio. • https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm https://www.fortra.com/security/advisory/fi-2024-005 • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25156 – Path traversal in GoAnywhere MFT 7.4.1 and Earlier
https://notcve.org/view.php?id=CVE-2024-25156
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Existe una vulnerabilidad de path traversal en GoAnywhere MFT anterior a 7.4.2 que permite a los atacantes eludir las comprobaciones de permisos específicos de los terminales en GoAnywhere Admin y Web Clients. • https://www.fortra.com/security/advisory/fi-2024-004 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25155 – Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier
https://notcve.org/view.php?id=CVE-2024-25155
In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag. En FileCatalyst Direct 3.8.8 y versiones anteriores hasta 3.8.6, el servidor web no sanitiza adecuadamente los caracteres ilegales en una URL que luego se muestra en una página de error posterior. Un actor malicioso podría crear una URL que luego ejecutaría código arbitrario dentro de una etiqueta de script HTML. • https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html https://www.fortra.com/security/advisory/fi-2024-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25154 – Path Traversal in FileCatalyst Direct 3.8.8 and Earlier
https://notcve.org/view.php?id=CVE-2024-25154
Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage. Una validación de URL incorrecta provoca un path traversal en FileCatalyst Direct 3.8.8 y versiones anteriores, lo que permite que un payload codificado haga que el servidor web devuelva archivos ubicados fuera de la raíz web, lo que puede provocar una fuga de datos. • https://filecatalyst.software/public/filecatalyst/Direct/3.8.9.90/whatsnew_direct.html https://www.fortra.com/security/advisory/fi-2024-003 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •