Code injection

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

Server side request forgery (ssrf)

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-8939

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8939

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8939

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-8939

CVE-2018-8939 describes a Server-Side Request Forgery (SSRF) in NmAPI.exe of Ipswitch WhatsUp Gold, affecting versions prior to 18.0. An attacker can submit specially crafted requests via NmAPI.exe to gain unauthorized access, obtain information about the WhatsUp Gold system, or execute remote co...

CVE-2018-8938

Ipswitch WhatsUp Gold before 18.0 is affected by a Code Injection vulnerability in DlgSelectMibFile.asp. A specially crafted SNMP MIB file can cause arbitrary command/code execution on the WhatsUp Gold server. Affected: WhatsUp Gold versions prior to 18.0. Root cause: errors in code generation/ha...

CVE-2018-8939: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8938: Improper Control of Generation of Code

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

PT-2018-1306 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 18.0 Description: A Server-Side Request Forgery SSRF issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to th...

PT-2018-1307 · Ipswitch · Ipswitch Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Ipswitch WhatsUp Gold versions prior to 18.0 Description: A Code Injection issue was discovered in DlgSelectMibFile.asp, related to errors in code generation management. This issue allows malicious actors to inject a specially crafted SNMP MI...

Ipswitch MoveIt Cross-Site Request Forgery Vulnerability

Ipswitch MoveIt is a suite of automated file transfer software from Ipswitch USA. It supports the control, management, and viewing of all business-critical file transfer activities through a single, secure system. A cross-site request forgery vulnerability exists in Ipswitch MoveIt version 8.1. A...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

Cross site scripting

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw (evidence references human.aspx). The vulnerability could allow attackers to deliver malicious messages to other MoveIt users, potentially stealing session cookies and enabling client-side attacks. The available connec...

CVE-2018-6545

Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks...