CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4561 – WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController
https://notcve.org/view.php?id=CVE-2024-4561
14 May 2024 — In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.2, existe una vulnerabilidad SSRF ciega en FaviconController de Whatsup Gold que permite a un atacante enviar solicitudes HTTP arbitrarias en nombre del servidor vulnerable. This vulnerability allows remote attackers to disclose sensitive i... • https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6368 – WhatsUp Gold Unauthenticated Access to an API Endpoint
https://notcve.org/view.php?id=CVE-2023-6368
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold. En las versiones de WhatsUp Gold lanzadas antes de 2023.1, se descubrió que a un endpoint de API le faltaba un mecanismo de autenticación. Es posible que un atacante no autenticado enumere información relacionada con un dispositivo registrado que está siendo... • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6595 – WhatsUp Gold Unauthenticated Access to an API Endpoint
https://notcve.org/view.php?id=CVE-2023-6595
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. En las versiones de WhatsUp Gold lanzadas antes de 2023.1, se descubrió que a un endpoint de API le faltaba un mecanismo de autenticación. Es posible que un atacante no autenticado enumere información de credenciales auxiliares almacenada en WhatsUp Gold. • https://github.com/sharmashreejaa/CVE-2023-6595 • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6367 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles
https://notcve.org/view.php?id=CVE-2023-6367
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacenadas. Es p... • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6366 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center
https://notcve.org/view.php?id=CVE-2023-6366
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacenada... • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6365 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups
https://notcve.org/view.php?id=CVE-2023-6365
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) almacena... • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6364 – WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard
https://notcve.org/view.php?id=CVE-2023-6364
14 Dec 2023 — In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victims browser. En las versiones de WhatsUp Gold lanzadas antes de la 2023.1, se identificó una vulnerabilidad de Cross-Site Scripting (XSS) A... • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-35759 – WhatsUp Gold 2022 22.1.0 Build 39 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2023-35759
23 Jun 2023 — In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. WhatsUp Gold 2022 version 22.1.0 Build 39 suffers from a persistent cross site scripting vulnerability. • https://packetstorm.news/files/id/176978 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42711
https://notcve.org/view.php?id=CVE-2022-42711
12 Oct 2022 — In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. En Progress WhatsUp Gold versiones anteriores a 22.1.0, un endpoint de la aplicación SNMP MIB Walker no saneaba apropiadamente la entrada maliciosa. Esto podría permitir a un atacante no autenticado ejecutar código arbitrario en el navegador de la víctima • https://community.progress.com/s/article/Product-Alert-Bulletin-October-2022 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •