2057 matches found
CVE-2026-78499: Server-Side Request Forgery (SSRF)
A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78616: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
CVE-2026-78612: Deserialization of Untrusted Data
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78174: Exposure of Sensitive Information to an Unauthorized Actor
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...
CVE-2026-78613: Improper Neutralization of Special Elements used in an SQL Command
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78615: Improper Neutralization of Input During Web Page Generation
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-78500: Observable Timing Discrepancy
A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-13108: Uncontrolled Resource Consumption
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service...
CVE-2026-78614: Deserialization of Untrusted Data
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78618: Improper Access Control
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...
CVE-2026-78047
CVE-2026-78047 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature (also referenced as "Scheduled Report Task" in the CNA record). A low-privileged authenticated administrator can inject arbitrary HTML or JavaScript into the scheduling fields, an...
CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test
A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task
A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...
CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...
CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...
CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings
A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test
A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...