Progress Software WhatsUp Gold Security Vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold version 2023.1.3, whi...

Progress Software WhatsUp Gold Security Vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold version 2023.1.3 that...

PT-2024-33921 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Progress WhatsUp Gold versions prior to 2023.1.3 Description: An Improper Access Control vulnerability exists in the Wug.UI.Controllers.InstallController.SetAdminPassword component of WhatsUp Gold. This vulnerability allows local attackers to...

PT-2024-33912 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue allows an authenticated user with certain permissions to upload an arbitrary file, which can lead to remote code execution RCE using the...

PT-2024-33971 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A Server Side Request Forgery issue exists in the GetASPReport feature, allowing any authenticated user to retrieve ASP reports from an HTML form. Recommendations: For versions prior to...

PT-2024-34002 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A path traversal issue exists, allowing information disclosure through a specially crafted unauthenticated HTTP request to the AppProfileImport endpoint. Recommendations: For versions prior...

PT-2024-33960 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: An unauthenticated Denial of Service issue was identified, allowing an unauthenticated attacker to put the application into the SetAdminPassword installation step. This renders the...

PT-2024-34013 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue allows for an unauthenticated Path Traversal, enabling the reading of any file from the application's web-root directory. This is due to a vulnerability in the...

CVE-2024-4883: Improper Neutralization of Special Elements used in a Command

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe...

PT-2024-34023 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue allows for an unauthenticated Arbitrary File Read, which exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This allows reading of any file with iisapppoolNmConso...

CVE-2024-5019: Improper Limitation of a Pathname to a Restricted Directory

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges...

Progress Software WhatsUp Gold Security Vulnerability

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold version 2023.1.3, whi...

CVE-2024-5011: Uncontrolled Resource Consumption

In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service...

PT-2024-33942 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue is related to an uncontrolled resource consumption vulnerability. A specially crafted unauthenticated HTTP request to the "TestController Chart" functionality can lead to denial o...

PT-2024-33246 · Progress · Progress Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Progress WhatsUp Gold versions prior to 2023.1.3 Description: A Remote Code Execution issue exists in Progress WhatsUp Gold, allowing an unauthenticated attacker to achieve Remote Code Execution as a service account through NmApi.exe...

CVE-2024-5016: Deserialization of Untrusted Data

In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage...

PT-2024-33932 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A vulnerability exists in the TestController functionality, allowing a specially crafted unauthenticated HTTP request to disclose sensitive information. Recommendations: For versions prior ...

CVE-2024-5014: Server-Side Request Forgery (SSRF)

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form...

CVE-2024-5009: Improper Privilege Management

In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password...

CVE-2024-5012: Improper Authentication

In WhatsUp Gold versions released before 2023.1.3, there is a missing authentication vulnerability in WUGDataAccess.Credentials. This vulnerability allows unauthenticated attackers to disclose Windows Credentials stored in the product Credential Library...