CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6364 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
https://notcve.org/view.php?id=CVE-2023-6364
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) Almacenada. Es posible que un atacante cree un payload XSS y almacene ese valor dentro de un componente del panel. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 https://www.progress.com/network-monitoring • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35759 – WhatsUp Gold 2022 22.1.0 Build 39 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2023-35759
In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. WhatsUp Gold 2022 version 22.1.0 Build 39 suffers from a persistent cross site scripting vulnerability. • http://packetstormsecurity.com/files/176978/WhatsUp-Gold-2022-22.1.0-Build-39-Cross-Site-Scripting.html https://community.progress.com/s/article/Product-Alert-Bulletin-June-2023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42711
https://notcve.org/view.php?id=CVE-2022-42711
In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. En Progress WhatsUp Gold versiones anteriores a 22.1.0, un endpoint de la aplicación SNMP MIB Walker no saneaba apropiadamente la entrada maliciosa. Esto podría permitir a un atacante no autenticado ejecutar código arbitrario en el navegador de la víctima • https://community.progress.com/s/article/Product-Alert-Bulletin-October-2022 https://www.progress.com https://www.progress.com/network-monitoring • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29846
https://notcve.org/view.php?id=CVE-2022-29846
In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number. En Ipswitch Progress WhatsUp Gold versiones 16.1 hasta 21.1.1, y 22.0.0, es posible que un atacante no autenticado obtenga el número de serie de la instalación de WhatsUp Gold • https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022 https://www.progress.com/network-monitoring •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8939
https://notcve.org/view.php?id=CVE-2018-8939
An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can submit specially crafted requests via the NmAPI executable to (1) gain unauthorized access to the WhatsUp Gold system, (2) obtain information about the WhatsUp Gold system, or (3) execute remote commands. Se ha descubierto una vulnerabilidad SSRF en NmAPI.exe en Ipswitch WhatsUp Gold en versiones anteriores al 2018 (18.0). Los actores maliciosos pueden enviar peticiones especialmente manipuladas mediante el ejecutable NmAPI para (1) obtener acceso no autorizado al sistema de WhatsUp Gold, (2) obtener información sobre el sistema de WhatsUp Gold o (3) ejecutar comandos remotos. • https://docs.ipswitch.com/NM/WhatsUpGold2018/01_ReleaseNotes/index.htm • CWE-918: Server-Side Request Forgery (SSRF) •