519 matches found
CVE-2019-18465: Missing Authentication for Critical Function
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH SFTP interface. The vulnerability affects only certain SSH SFTP configurations, and is applicable only if the MySQL database is being used...
PT-2019-15422
Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions 11.1 through 11.1.2 Description A vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH SFTP interface. The issue affects only certain SSH SFTP configurations and is...
CVE-2019-18464: Improper Neutralization of Special Elements used in an SQL Command
In Progress MOVEit Transfer 10.2 before 10.2.6 2018.3, 11.0 before 11.0.4 2019.0.4, and 11.1 before 11.1.3 2019.1.3, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the...
Progress Software MOVEit Transfer SQL Injection Vulnerability
Progress Software MOVEit Transfer is an automated file transfer software from Progress Software, USA. The software supports file transfer and provides file transfer activity monitoring. A SQL injection vulnerability exists in the MOVEit.DMZ.WebApi.dll file in Progress Software MOVEit Transfer,...
CVE-2019-16383
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...
CVE-2019-16383
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...
Sql injection
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...
CVE-2019-16383
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...
CVE-2019-16383: Improper Neutralization of Special Elements used in an SQL Command
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used MySQL, Microsoft SQL Server, or Azure SQL, an attacker...
PT-2019-14650
Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions 2018 SP2 before 10.2.4 Progress MOVEit Transfer versions 2019 before 11.0.2 Progress MOVEit Transfer versions 2019.1 before 11.1.1 Description The issue allows an unauthenticated attacker to gain unauthorized...
Ipswitch MOVEit Transfer Security Bypass Vulnerability
Ipswitch MOVEit Transfer formerly DMZ an automated file transfer system from Ipswitch USA. The system supports the control, management, and viewing of all business-critical file transfer activities through a single, secure system. A security bypass vulnerability exists in Ipswitch MOVEit Transfer...
CVE-2017-6195
Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20...
Sql injection
Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20...
CVE-2017-6195
Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20...
CVE-2017-6195
CVE-2017-6195 concerns pre-authentication blind SQL injection in Ipswitch MOVEit Transfer (now Progress MOVEit Transfer) and MOVEit DMZ. Affected products include MOVEit Transfer (2017) and MOVEit DMZ, with fixed versions MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.2...
CVE-2017-6195
Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20...
PT-2017-16941
Name of the Vulnerable Software and Affected Versions Ipswitch MOVEit Transfer versions prior to 2017 9.0.0.201 Ipswitch MOVEit DMZ versions prior to 8.3.0.30 Ipswitch MOVEit DMZ versions prior to 8.2.0.20 Description The issue allows for pre-authentication blind SQL injection. Recommendations Fo...
CVE-2017-6195: Improper Neutralization of Special Elements used in an SQL Command
Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201, MOVEit DMZ 8.3.0.30, and MOVEit DMZ 8.2.0.20...
