CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-33894
https://notcve.org/view.php?id=CVE-2021-33894
In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements. En Progress MOVEit Transfer versiones anteriores a 2019.0.6 (11.0.6), versiones 2019.1.x anteriores a 2019.1.5 (11.1.5), versiones 2019.2.x anteriores a 2019.2.2 (11.2.2), versiones 2020.x anteriores a 2020.0.5 (12.0.5), versiones 2020.1. x anteriores a 2020.1.4 (12.1.4), y versiones 2021.x anteriores a 2021.0.1 (13.0.1), se presenta una vulnerabilidad de inyección SQL en el archivo SILUtility.vb en la función MOVEit.DMZ.WebApp en la aplicación web MOVEit Transfer. Esto podría permitir a un atacante autenticado conseguir acceso no autorizado a la base de datos. • https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-June-2021 https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31827
https://notcve.org/view.php?id=CVE-2021-31827
In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb. En Progress MOVEit Transfer versiones anteriores a 2021.0 (13.0), ha sido encontrado una vulnerabilidad de inyección SQL en la aplicación web MOVEit Transfer que podría permitir a un atacante autenticado conseguir acceso no autorizado a la base de datos de MOVEit Transfer. Dependiendo del motor de base de datos que sea usado (MySQL, Microsoft SQL Server o Azure SQL), un atacante puede ser capaz de inferir información sobre la estructura y el contenido de la base de datos, además de ejecutar sentencias SQL que alteren o destruyan elementos de la base de datos. • https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-April-2021 https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm https://www.progress.com/moveit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28647
https://notcve.org/view.php?id=CVE-2020-28647
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS). En Progress MOVEit Transfer versiones anteriores a 2020.1, un usuario malicioso podría crear y almacenar una carga útil dentro de la aplicación. Si una víctima dentro de la instancia de MOVEit Transfer interactúa con la carga útil almacenada, podría invocar y ejecutar código arbitrario dentro del contexto del navegador de la víctima (XSS) • https://github.com/SECFORCE/Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647 https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-Nov-2020 https://labs.secforce.com/posts/progress-moveit-transfer-2020.1-stored-xss-cve-2020-28647 https://www.progress.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18464
https://notcve.org/view.php?id=CVE-2019-18464
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database. En Progress MOVEit Transfer versiones 10.2 anteriores a 10.2.6 (2018.3), versiones 11.0 anteriores a 11.0.4 (2019.0.4) y versiones 11.1 anteriores a 11.1.3 (2019.1.3), se han encontrado múltiples vulnerabilidades de inyección SQL en la API REST que podrían permitir a un atacante no autenticado conseguir acceso no autorizado a la base de datos. Dependiendo del motor de base de datos que está siendo usado (MySQL, Microsoft SQL Server o Azure SQL), un atacante puede ser capaz de inferir información sobre la estructura y el contenido de la base de datos o puede ser capaz de alterar la base de datos. • https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2 https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.4EPSS: 0%CPEs: 3EXPL: 1CVE-2019-16383 – MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2019-16383
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection. La biblioteca MOVEit.DMZ.WebApi.dll en Progress MOVEit Transfer 2018 SP2 versiones anteriores a 10.2.4, 2019 versiones anteriores a 11.0.2 y 2019.1 versiones anteriores 11.1.1, permite a un atacante no autenticado conseguir acceso no autorizado a la base de datos. Dependiendo del motor de base de datos que esta siendo usado (MySQL, Microsoft SQL Server o Azure SQL), un atacante puede inferir información sobre la estructura y el contenido de la base de datos, o puede alterar la base de datos por medio de la API REST, también se conoce como Inyección SQL. MOVEit Transfer version 11.1.1 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/48316 http://packetstormsecurity.com/files/157208/MOVEit-Transfer-11.1.1-SQL-Injection.html https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability https://docs.ipswitch.com/MOVEit/Transfer2018SP2/ReleaseNotes/en/index.htm#46490.htm https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm https://docs.ipswitch.com/MOVEit/Transfer2019_1/ReleaseNotes/en/index.htm#49443.htm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •