Vulnerabilities > Ipswitch > Medium

DATE CVE VULNERABILITY TITLE RISK
2019-10-31 CVE-2019-18465 Missing Authentication for Critical Function vulnerability in Ipswitch Moveit Transfer 11.1/11.1.1
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface.
network
ipswitch CWE-306
6.8
2019-06-11 CVE-2019-12146 Path Traversal vulnerability in Ipswitch WS FTP Server
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
network
low complexity
ipswitch CWE-22
6.4
2019-06-11 CVE-2019-12145 Path Traversal vulnerability in Ipswitch WS FTP Server
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1.
network
low complexity
ipswitch CWE-22
5.0
2018-02-02 CVE-2018-6545 Cross-site Scripting vulnerability in Ipswitch Moveit 8.1
Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx.
network
ipswitch CWE-79
4.3
2017-11-03 CVE-2017-16513 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Ipswitch WS FTP
Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729.
local
low complexity
ipswitch CWE-119
4.6
2016-02-10 CVE-2015-7680 Information Exposure vulnerability in Ipswitch Moveit DMZ 8.1
Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.
network
low complexity
ipswitch CWE-200
5.0
2016-02-10 CVE-2015-7679 Cross-site Scripting vulnerability in Ipswitch Moveit Mobile 1.2.0.962
Cross-site scripting (XSS) vulnerability in Ipswitch MOVEit Mobile before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the query string to mobile/.
network
ipswitch CWE-79
4.3
2016-02-10 CVE-2015-7678 Cross-Site Request Forgery (CSRF) vulnerability in Ipswitch Moveit Mobile 1.2.0.962
Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
network
ipswitch CWE-352
6.8
2016-02-10 CVE-2015-7677 Information Exposure vulnerability in Ipswitch Moveit DMZ 8.1
The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll.
network
low complexity
ipswitch CWE-200
4.0
2016-02-10 CVE-2015-7675 Information Exposure vulnerability in Ipswitch Moveit DMZ and Moveit Mobile
The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the (1) serverFileIds parameter to mobile/sendMsg or (2) arg01 parameter to human.aspx.
network
low complexity
ipswitch CWE-200
4.0