CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18464
https://notcve.org/view.php?id=CVE-2019-18464
31 Oct 2019 — In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database. En Prog... • https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability-2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18465
https://notcve.org/view.php?id=CVE-2019-18465
31 Oct 2019 — In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used. En Progress MOVEit Transfer versiones 11.1 anteriores a 11.1.3, se ha encontrado una vulnerabilidad que podría permitir a un atacante iniciar sesión sin credenciales completas por medio de la interfaz SSH (SFTP).... • https://community.ipswitch.com/s/article/SFTP-Auth-Vulnerability • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.4EPSS: 0%CPEs: 3EXPL: 2CVE-2019-16383 – MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2019-16383
24 Sep 2019 — MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection. La biblioteca MOVEit.DMZ.WebApi.dll en Progress MOVEit ... • https://packetstorm.news/files/id/157208 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-6545
https://notcve.org/view.php?id=CVE-2018-6545
02 Feb 2018 — Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks. Ipswitch MoveIt v8.1 es vulnerable a Cross-Site Scripting (XSS) persistente, tal y como queda demostrado con human.aspx. Los atacantes podrían aprovecharse de esta vulnerabilidad para enviar mensajes maliciosos a otros usuarios para robar las... • https://crowdshield.com/blog.php?name=ipswitch-moveit-stored-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-6195
https://notcve.org/view.php?id=CVE-2017-6195
18 May 2017 — Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20. Ipswitch MOVEit Transfer (anteriormente conocido como DMZ) permite inyección SQL ciega de preautenticación. Las versiones solucionadas son MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30 y MOVEit DMZ 8.2.0.20. • http://ft.ipswitch.com/rs/751-HBN-596/images/Ipswitch-Security-Bulletin-FT-Vulnerability.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7677 – Ipswitch MOVEit DMZ 8.1 File ID Enumeration
https://notcve.org/view.php?id=CVE-2015-7677
28 Jan 2016 — The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll. El servicio MOVEitISAPI en Ipswitch MOVEit DMZ en versiones anteriores a 8.2 proporciona mensajes de error diferentes en función de si existe un FileID, lo que permite a usuarios remotos autenticados enumerar FileIDs a través del pará... • https://packetstorm.news/files/id/135459 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 3CVE-2015-7675 – Ipswitch MOVEit DMZ 8.1 Authorization Bypass
https://notcve.org/view.php?id=CVE-2015-7675
28 Jan 2016 — The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx. La funcionalidad "Send as attachment" en Ipswitch MOVEit DMZ en versiones anteriores a 8.2 y MOVEit Mobile en versiones anteriores a 1.2.2 permite a usuarios remotos autenticados eludir la autorización y leer archivos carga... • https://packetstorm.news/files/id/135457 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-7678 – Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-7678
28 Jan 2016 — Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de CSRF en Ipswitch MOVEit Mobile 1.2.0.962 y versiones anteriores permiten a atacantes remotos secuestrar la autenticación de víctimas no especificadas a través de vectores desconocidos. Ipswitch MOVEit Mobile versions 1.2.0.962 and below suffer from a cross site request forgery v... • https://packetstorm.news/files/id/135460 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2015-7679 – Ipswitch MOVEit Mobile 1.2.0.962 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-7679
28 Jan 2016 — Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/. Vulnerabilidad de XSS en Ipswitch MOVEit Mobile en versiones anteriores a 1.2.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cadena query a mobile/. Ipswitch MOVEit Mobile versions 1.2.0.962 and below suffer from a reflective cross site scripting vulnerability. • https://packetstorm.news/files/id/135461 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 3CVE-2015-7680 – Ipswitch MOVEit DMZ 8.1 Information Disclosure
https://notcve.org/view.php?id=CVE-2015-7680
28 Jan 2016 — Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx. Ipswitch MOVEit DMZ en versiones anteriores a 8.2 provee diferentes mensajes de error de intentos de autenticación en función de si existe la cuenta de usuario, lo que permite a atacantes remotos enumerar nombres de usuario a través de una serie de peticiones SOAP a machin... • https://packetstorm.news/files/id/135462 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •