Code injection

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll...

Authentication flaw

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx...

CVE-2015-7675

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the 1 serverFileIds parameter to mobile/sendMsg or 2 arg01 parameter to human.aspx...

CVE-2015-7675

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the 1 serverFileIds parameter to mobile/sendMsg or 2 arg01 parameter to human.aspx...

CVE-2015-7677

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll...

CVE-2015-7675

The CVE-2015-7675 issue affects Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2. It stems from improper authorization checks in the Send as attachment workflow: an authenticated attacker can supply a valid FileID via serverFileIds (mobile/sendMsg) or arg01 (human.aspx) to bypass aut...

CVE-2015-7680

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx...

CVE-2015-7680

Ipswitch MOVEit DMZ before 8.2 is affected. An unauthenticated attacker can enumerate valid usernames by sending SOAP requests to machine.aspx, due to different error messages depending on account existence. Root cause: inconsistent error handling that leaks existence information. Impact: informa...

CVE-2015-7677

CVE-2015-7677 affects Ipswitch MOVEit DMZ (before 8.2) via the MOVEitISAPI service. The issue exposes information disclosure: remote authenticated users can enumerate FileIDs by sending a request to MOVEitISAPI/MOVEitISAPI.dll using the X-siLock-FileID parameter in a download action, taking advan...

PT-2016-3824

Name of the Vulnerable Software and Affected Versions Ipswitch MOVEit DMZ versions prior to 8.2 Description The issue allows remote attackers to enumerate usernames by analyzing different error messages for authentication attempts, depending on whether the user account exists. This can be achieve...

PT-2016-3821

Name of the Vulnerable Software and Affected Versions Ipswitch MOVEit DMZ versions prior to 8.2 Description The issue allows remote authenticated users to enumerate FileIDs due to different error messages provided by the MOVEitISAPI service, depending on whether a FileID exists. This can be...

PT-2016-3819

Name of the Vulnerable Software and Affected Versions Ipswitch MOVEit DMZ versions prior to 8.2 Ipswitch MOVEit Mobile versions prior to 1.2.2 Description The issue allows remote authenticated users to bypass authorization and read uploaded files. This can be achieved by providing a valid FileID ...

CVE-2015-7680: Exposure of Sensitive Information to an Unauthorized Actor

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx...

CVE-2015-7677: Exposure of Sensitive Information to an Unauthorized Actor

The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll...

CVE-2015-7675: Exposure of Sensitive Information to an Unauthorized Actor

The "Send as attachment" feature in Ipswitch MOVEit DMZ before 8.2 and MOVEit Mobile before 1.2.2 allow remote authenticated users to bypass authorization and read uploaded files via a valid FileID in the 1 serverFileIds parameter to mobile/sendMsg or 2 arg01 parameter to human.aspx...

Ipswitch MOVEit DMZ 8.1 Persistent Cross Site Scripting

Profundis Labs - Security Advisory Vulnerability Title ================== Persistent Cross-Site-Scripting XSS vulnerability by file upload due to insecure default configuration Vendor: ======= Ipswitch, Inc http://www.ipswitchft.com Product: ======== MOVEit File Transfer MOVEit is an automated fi...

Honeywell Midas gas detector is exposed to serious vulnerabilities, and then to industrial safety Alarm bell-vulnerability warning-the black bar safety net

! Well-known high-tech manufacturing company Honeywell recently released a firmware update package to fix Midas gas detector of two high-risk vulnerabilities. This is a turnover of 3 0 0 the multi-billion-dollar diversified technology and manufacturing company in the world has its business...

WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities

Exploit Title: WIMAX LX350PWIXFMR-108 - Multiple Vulnerabilities Date: ˝Friday, ˝December ˝11, ˝2015 Exploit/Vulnerability Author: Alireza Azimzadeh Milani alimp5 Vendor Homepage: http://www.greenpacket.com Version: v2.10.14-g1.5.2 Tested on: Kali-Linux I'm an ethical penetration tester and super...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06808)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle. An unspecified vulnerability exists in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4. Allowing authenticated remote users about diagnostics and DMZ vectors compromises integri...

CVE-2015-4898

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via vectors related to Diagnostics and DMZ...