CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4884 – WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4884
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, se detectó una vulnerabilidad de ejecución remota de código no autenticada en WhatsUpGold en curso. Apm.UI.Areas.APM.Controllers.CommunityController permite la ejecución de comandos con privilegios de iisapppool\nmconsole. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4883 – WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4883
In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, existe un problema de ejecución remota de código en Progress WhatsUp Gold. Esta vulnerabilidad permite que un atacante no autenticado obtenga RCE como cuenta de servicio a través de NmApi.exe. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. • https://github.com/sinsinology/CVE-2024-4883 https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 1CVE-2024-5806 – MOVEit Transfer Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-5806
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2. • https://github.com/watchtowrlabs/watchTowr-vs-progress-moveit_CVE-2024-5806 https://community.progress.com/s/article/MOVEit-Transfer-Product-Security-Alert-Bulletin-June-2024-CVE-2024-5806 https://www.progress.com/moveit https://attackerkb.com/topics/44EZLG2xgL/cve-2024-5806/rapid7-analysis • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5805 – MOVEit Gateway Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2024-5805
Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0. • https://community.progress.com/s/article/MOVEit-Gateway-Critical-Security-Alert-Bulletin-June-2024-CVE-2024-5805 https://www.progress.com/moveit • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4837 – Trust Boundary Violation Vulnerability
https://notcve.org/view.php?id=CVE-2024-4837
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability. En Progress Telerik Report Server, versión 2024 Q1 (10.0.24.305) o anterior, en IIS, un atacante no autenticado puede obtener acceso a la funcionalidad restringida de Telerik Report Server a través de una vulnerabilidad de violación de los límites de confianza. • https://docs.telerik.com/report-server/knowledge-base/information-exposure-cve-2024-4837 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •